From: Ed W <lists@wildgooses.com>
To: Jan Engelhardt <jengelh@medozas.de>
Cc: Andrew Beverley <andy@andybev.com>,
Netfilter <netfilter@vger.kernel.org>
Subject: Re: High accuracy bandwidth accounting?
Date: Mon, 16 May 2011 17:53:43 +0100 [thread overview]
Message-ID: <4DD15697.4080505@wildgooses.com> (raw)
In-Reply-To: <alpine.LNX.2.01.1105161655440.8681@frira.zrqbmnf.qr>
>> So my test is "nslookup www.yahoo.co.uk" and both tcpdump and conntrack -E dumps are
>> below:
>
> Modern times - modern tools: host(1).
Busybox... :-(
>> This feels to me like a packet which has fallen between two
>> situations. It's not a new connection so it didn't get logged as
>> such. It's also kind of not obviously part of the existing
>> connection so it doesn't get logged as such either?
>
> Something like that. Check the state of this ICMP packet with -j
> LOGMARK from Xtables-addons. I'd be interested in what it belongs to.
Because this is an embedded device and my build scripts are currently broken at the moment (being rewritten...), adding xtables-addons to the device is slightly tricky right now...
(I think I need some more linux development machines here... All the other linux machines here are "production" servers... Hmm)
After some thought, this command line *seems* to reproduce the problem - would someone with LOGMARK available be kind enough to reproduce this:
nslookup www.yahoo.co.uk & sleep 0.01 && killall nslookup
16:45:02.034285 IP 10.94.230.137.38407 > 8.8.8.8.domain: 2+ PTR? 8.8.8.8.in-addr.arpa. (38)
16:45:02.316397 IP 8.8.8.8.domain > 10.94.230.137.38407: 2 1/0/0 PTR google-public-dns-a.google.com. (82)
16:45:02.316522 IP 10.94.230.137 > 8.8.8.8: ICMP 10.94.230.137 udp port 38407 unreachable, length 118
[NEW] udp 17 30 src=10.94.230.137 dst=8.8.8.8 sport=38407 dport=53 [UNREPLIED] src=8.8.8.8 dst=10.94.230.137 sport=53 dport=38407
[UPDATE] udp 17 29 src=10.94.230.137 dst=8.8.8.8 sport=38407 dport=53 src=8.8.8.8 dst=10.94.230.137 sport=53 dport=38407
[DESTROY] udp 17 src=10.94.230.137 dst=8.8.8.8 sport=38407 dport=53 packets=1 bytes=66 src=8.8.8.8 dst=10.94.230.137 sport=53 dport=38407 packets=1 bytes=110
(Obviously s/nslookup/host/ as appropriate...)
This seems like a smaller reproducible test case? The only caveat is that the "sleep x" be smaller than the RTT to the DNS server - using a real DNS server on the internet makes this straightforward.
Thanks
Ed W
next prev parent reply other threads:[~2011-05-16 16:53 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-05-09 14:12 High accuracy bandwidth accounting? Ed W
2011-05-09 21:45 ` Andrew Beverley
2011-05-09 22:07 ` Ed W
2011-05-09 22:16 ` Andrew Beverley
2011-05-09 22:49 ` Ed W
2011-05-11 14:30 ` Ed W
2011-05-12 0:01 ` Andrew Beverley
2011-05-12 22:17 ` Ed W
2011-05-12 22:27 ` Andrew Beverley
2011-05-09 23:23 ` Ed W
2011-05-14 9:23 ` Andrew Beverley
2011-05-14 13:36 ` Ed W
2011-05-14 16:29 ` Andrew Beverley
2011-05-14 22:33 ` Jan Engelhardt
2011-05-15 7:23 ` Andrew Beverley
2011-05-15 9:08 ` Jan Engelhardt
2011-05-16 6:43 ` Andrew Beverley
2011-05-16 7:23 ` Jan Engelhardt
2011-05-22 21:22 ` Andrew Beverley
2011-05-16 14:35 ` Ed W
2011-05-16 14:59 ` Jan Engelhardt
2011-05-16 16:53 ` Ed W [this message]
2011-05-14 9:48 ` Marek Kierdelewicz
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4DD15697.4080505@wildgooses.com \
--to=lists@wildgooses.com \
--cc=andy@andybev.com \
--cc=jengelh@medozas.de \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).