Traffic graph not shown for local ips

[scorpoin]

@stephenw10

Patch applied but didnt work for me :/ .

[jrey]

@stephenw10

Observation from 23.09.b.20231023.1701

if the selection is "rate (standard)" the IP list will populate and then clear immediately with each refresh (so the list mostly appears empty)

if the selection is "iftop (experimental)" the IP list will populate and then just refresh with the update (so there is always IP addresses in the list)

Edit: and the selection for WAN does the same thing. "rate" standard shows the IP updates periodically and clears list. "iftop" the ip stays in the list and the bandwidths just refresh.

[stephenw10]

Yes, that's true. The output from rate is filtered every time it refreshes and the list is rewritten each time.

One thing I have seen is that if you change from rate to iftop (or the other way) you may need to switch interfaces in order to see that.

[jrey]

@stephenw10

when on rate it always clears immediately after a refresh, and when on iftop is does not. Doesn't matter what else you flip back and forth. Able to reproduce 100%

rate = refresh, clear list (you only see the IPs momentarily)
iftop = refresh, list not cleared. (likely more correctly stated as clear, refresh)

but the end result is you can see the IP list on iftop and not on rate
at least with 23.09.b.20231023.1701 that is my observation.

[stephenw10]

What exactly do you see then? I see what I'm expecting there:

Most of those are other pfSense instances pinging the LAN.

[jrey]

@stephenw10

with rate set - the list populates momentarily (on every refresh), clears then is blank
so mostly displays like this (can't really tell what was on the list because it goes blank as soon as the list is done, the IPs are listed only as long as it takes to draw the list.)

on the there hand, with iftop (it just refreshes, there is always something shown (it might actually be a clear->refresh, the refresh is too fast to tell) but the result is like this and certainly the list is changing based on the refresh.

[jrey]

@stephenw10

Can eliminate the browser - just tried the same test from another box with different OS / browser and it does exactly the same thing there.

[tedquade]

@jrey I have the same issue as you.

Ted

[stephenw10]

If you start something continuous does it show up on every refresh?

[tedquade]

@stephenw10 Data to the right of the graph shows briefly then disappears.

Ted

[jrey]

@stephenw10

it is consistent in operation, the graph is updating as the traffic changes the list is always displaying when refreshed as described. There is never a case where there is no traffic, if that's what you mean be "start something continuous" there is always traffic, although the IPs might change and sort as expected.

rate = refresh -> ends in blank list (the list isn't visible long enough to read)

iftop = refresh -> ends with list still displayed.

[stephenw10]

Hmm, and the process you start is passing enough traffic that client should be top of the list?

[jrey]

@stephenw10
You tell me

is this enough traffic to make IP address show on the list ? and again they do show momentarily until the refresh is done then the list clears

this is rate (I can't really tell you what the traffic is per IP because the list doesn't stay visible long enough. The list is mostly in a blank state except during an actual refresh, when the IPs appear briefly and immediately disappear) - point is, there is no value in "flashing" IPs in this list and not leaving them visible long enough from someone to read. if there are 5+ IPs on the list, (and this is common here), by the time you look and scan the list, to find the one you are looking for, the list is gone. So blank most of the time even thought the traffic is still flowing. Based on where I think you are going with "start something continuous" ) the list is empty. If the expectation is that, that IP should remain listed based on traffic level or duration, IMHO it does not. (aka packet capture on a specific IP confirms there is consistent traffic, and yet the list shows empty.)
additionally I've got an iPhone downloading the 17.1 iOS update as I type (the IP that phone is on is doing about 255M/sec and the list refreshed several times and clears - is blank) the download lasted about maybe about 10 seconds in total. The IP only showed on the list right at the start of the download, the list was empty for perhaps 8-9 of those seconds) ie "mostly empty" the IP did not remain listed for the duration of the download, even though other devices clearly appeared and left the list during the same timeframe.

this is most likely why the list is "flashing" and empty most of the time.
both not following long traffic for duration and;
short bursts traffic (< refresh interval) just come and go.

whereas this is iftop - there are always IPs listed (list is never blank) and they bounce around based on the sort order and what they are doing with each refresh. (the iPhone remained top of the list during the download)

[stephenw10]

And that's with the patch applied? For the one refresh it did appear did it show the correct bandwidth, 250Mbps?

[jrey]

@stephenw10

yes it did show the 250Mbps initially, but it also shows traffic with much lower rate initially as well. I don't think it has as much to do with rate as it does with duration of traffic

I believe the original discussion was regarding 2.7 and a mention of 23.05.1

so no patch applied prior, I'm on the Beta 23.09.b.20231023.1701
and wanted to report/confirm the observation there as well,
while waiting for the pending RC.

applied the patch, navigated back to the page and

not really seeing a difference for the amount of traffic on the graph. During that segment of graph shown from page load, 2 IPs have briefly appeared on the list, but certainly not remaining there while there is clearly traffic

logged out back in - no change
close browser - reload - login - no change

cached server side perhaps ? only thing I can think of is restart the web GUI or reboot the system. (or wait for the RC which will do both of those and test it again.)

But then I noticed that although it says applied (and I have the option to revert) it wasn't a 100% clean apply

Debug shows

Thanks

[jrey]

@stephenw10

revert (yup is reverted but with this)

[stephenw10]

Huh, that in itself seems like a bug. Although that output looks like what you should see if you try to debug applying it when it's already applied?

There are two things the patch does:

1. Before the patch setting the filter to remote still showed all the local IP addresses. It should filter correctly with the patch.
2. Before patching the local filter excluded traffic that was just within the local subnet so that included traffic from clients to the firewall itself. Those now show.

If the connections do not show in the output from rate at all for some reason then the patch won't help.

Steve

[jrey]

@stephenw10

Not sure what to tell you - this is the only patch applied (once) and since reverted (once) - and there are no other patches on the beta.

I'll try again after the RC. It's no big deal I don't sit on these screens monitoring traffic. I was only poking because of the beta.

[stephenw10]

Strange. It reverts and applies cleanly everywhere I've tried it.
Let's revisit in RC.

[jrey]

@stephenw10

Strange indeed. So I made it work on this system / beta 23.09.b.20231023.1701

Not sure why, as the original patch as provided indicated at least by the system the patch applied.

1. I downloaded * the original version of the inc file being patched to another machine
2. modified the patch provided removing the change at line 20 and the one at the end referencing line 208
   This leaving only the two actual changes of significance in the diff - so the patch now contains only this before applying
   

3 Applied that modified patch (still apply OK, ie Revert Button appears, apply says good)
4 revisit the graph, surprise the IPs hang around longer and the list does not appear mostly empty.
5 download * the now patched inc file to other machine
6 revert the patch, confirm the graph has no IPs

So the patch itself does work
Now for the two files I downloaded. (the one at step 1 the original and step 5 the patched)
run a diff on these and get

remember I modified the original patch before applying
the difference in this new diff (the change reported at line 20 is back the same as the original, but the change regarding the end of file (line 208) is not.

So strange indeed..

When the RC comes out, I'll let it settle in a while and try this all again. starting with the original patch, and then following through with modifying it and trying again if needed.