Incorrect bandwidth monitor values
-
Well either the values reported by pf are incorrect or RRD is pulling data from the wrong sources.
Check: /var/db/rrd/updaterrd.sh
That will show you where RRD is pulling data from for WAN out.
Steve
-
This post is deleted! -
Well first off all does the data coming from pfctl look correct to you? I have no way to know if you have reset the interfaces etc.
If not then we can try to dig into that. I've never seen that come back incorrectly though.Do you have any rules on WAN that are passing without logging perhaps or somehow passing without creating a state even? Hard to imagine you would but...
Steve
-
This post is deleted! -
Is the last cleared date you're seeing there when pfSense was last rebooted?
-
This post is deleted! -
Hmm, do you see an outbound state for the openvpn traffic on vmx1?
-
This post is deleted! -
Hmm, you could try something more radical like importing the config into a new VM and seeing if it's still replicated.
-
This post is deleted! -
Mmm, I mean it looks like some values have been switched somehow such that pf is referencing the wrong interface(s). But if that was the case I would expect the policy routing and firewall rules to also be wrong. Also I've never seen that happen before and really I have no idea how it could!
I could imagine the interfaces becomes switched, for example ovpnc2 is no longer the tunnel you think it is. Or the interfaces are re-ordered in vmware. But that would not account for traffic switching from vmx to ovpn.
-
This post is deleted! -
You could create a new NIC on the same vswitch and then reassign WAN to that, vmx2 for example.
pf has an interface for all OpenVPN traffic that is uses for firewall rules on unassigned interfaces. I wonder if somehow the ovpnc8 graph is pulling data from that. Though that would still include data from ovpnc9.
For anything like that to happen it would have to very low level. I assume ifconfig still reports the correct number of interfaces with the correct names?
Steve
-
This post is deleted! -
This post is deleted! -
@hvr-lust said in Incorrect bandwidth monitor values:
PPROMISC
Hmm, that's.... interesting!
Is it in a bridge by any chance? Or are any of those interfaces in a bridge?
I wouldn't normally expect to see a TAP mode client in a bridge in that sort of setup but...
Steve
-
This post is deleted! -
Mmm, it seems the interface is being used in some unexpected way to cause it to be flagged like that. This seems very likely to be related.
Steve
-
And the actual pfctl output shows that data on the wrong interfaces too?
-
It would be good to test a 2.7 snapshot if you can. There have been a lot of pf changes there recently. There's a good chance it will at least behave differently.
