[SOLVED] Traffic graph weirdness

maverick_slo

Hi!

I`m on yesterdays snapshot and this is bothering me for a long time…

I`m downloading with 4MB/s and WAN is showing correct traffic.
But LAN doubles it. Why?

PiBa

Looks fine for me. see attachment.. Not sure why your graph would be that different..

While downloading does iftop show your same double bandwidth for the connection on lan side?
Does tcpdump show any 'extra' traffic? Is everything re-transmitted?

Is it virtual? Bridged? Lacp? Or anything else 'special'?

![2017-08-01 20_48_48-Status_ Dashboard - pfSe.localdomain.png](/public/imported_attachments/1/2017-08-01 20_48_48-Status_ Dashboard - pfSe.localdomain.png)
![2017-08-01 20_48_48-Status_ Dashboard - pfSe.localdomain.png_thumb](/public/imported_attachments/1/2017-08-01 20_48_48-Status_ Dashboard - pfSe.localdomain.png_thumb)

maverick_slo

Hi.
Nothing special but I think only http traffic is counted like this, need to confirm that first.
No bridge or lacp, just vlans and thats it.

maverick_slo

OK.
So…
No retransmissions.
All traffic affected.
Iftop shows correct data
Traffic graph is wrong.
Tried 3 browsers same thing.
Ipv6 and IPv4 are both affected
Tried with 4 machines on LAN
Only DOWNLOAD is affected, upload from LAN to WAN displays correct data.

WTF :)

maverick_slo

It seems that only "out" is affected.
That`s weird.

Harvy66

Are you using VLANs?

maverick_slo

post no. 3
yes

Harvy66

Do you have any untagged VLANs on that physical network interface?

maverick_slo

nope, all 4 tagged

scott83

I'm running 2.4.0.b.20170802.1526 and I'm in the same boat, my tagged VLAN interface out is showing double of my WAN in. I also verified using iftop that the VLAN interface is not showing double, only the traffic graph does. I also have 4 tagged VLANs on that interface and no untagged VLANs.

jahonix

Double-quoted traffic on VLAN interfaces was a problem in the past but solved (about a year or so ago).
Seems to be newly featured on Github again. Report on Redmine!

maverick_slo

done
https://redmine.pfsense.org/issues/7751

maverick_slo

Hi!

Any idea if this is pfsense bug or upstream?
I would really like this to be resolved in 2.4…

PiBa

Maybe you could install "nload" on ssh/console?

pkg add http://pkg.freebsd.org/freebsd:11:x86:64/latest/All/nload-0.7.4_1.txz

Start it use arrows to switch to desired nic/vlan and compare with traffic graphs.

It should pull statistics from sysctl just like pfSense.. And if also wrong then points a little to freebsd.
Though i suppose it could still be a issue introduced by pfSense's changes somewhere..

maverick_slo

Hehe :)
So here we go, guess pfsense bug after all….

PiBa

Oké i guess its still not 100% definitive…

Pfsense calls sysctl with:

CTL_NET, PF_LINK, NETLINK_GENERIC, IFMIB_IFDATA, {ifidx}, IFDATA_GENERAL

Where it retrieves the data: bytes, packets, collisions, multicasts, mtu
https://github.com/pfsense/FreeBSD-ports/blob/devel/devel/php56-pfSense-module/files/pfSense.c#L3210

While nload calls sysctl with:

CTL_NET, PF_ROUTE, 0, 0, NET_RT_IFLIST, 0

Where it retrieves the data: bytes, packets, errors
https://github.com/liuyang1/nload/blob/master/src/devreader-bsd.cpp#L108

So its similar but not the same, and that might be for a good reason. I'm not exactly sure.. Though i guess most of those extra data items are not needed for traffic graphs..

maverick_slo

Jarred is on the case
Maybe just fewer flags and thats it.

jdillard

I think this is the issue jahonix was referring to: https://redmine.pfsense.org/issues/3314

If that's the case someone else might pick up the ticket, but for now I'll try and find the commit with the patch.

edit: I tried running:

git log --since "MAY 18 2015" --until "MAY 20 2015" --pretty=format:"%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%ad) %C(bold blue)<%an>%Creset"

on the following repos:


pfsense/pfsense
pfsense/FreeBSD-ports
pfsense/FreeBSD-src

without any luck finding the patch so far. I may have accidentally missed it or be taking the wrong approach.

PiBa

Found it: https://github.com/pfsense/pfsense-tools/commit/ad55e66a3fb817f8e54bae7bf38306039b82e3ad

Or: https://github.com/pfsense/FreeBSD-src/commit/939f11b196e7d22a1ce3da8533e97ff3e92510b6#diff-437f2b0c100f75faf75f7c5b60eca6a4R1156

PiBa

2.3:

 			ifp->if_opackets++;
 			//ifp->if_omcasts += mcast;
 			//ifp->if_obytes += len;

2.4:

			if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
			if_inc_counter(ifp, IFCOUNTER_OBYTES, len);
			if_inc_counter(ifp, IFCOUNTER_OMCASTS, mcast);

In 2.4 it looks different.. probably needs some // as well.. https://github.com/pfsense/FreeBSD-src/blob/RELENG_2_4/sys/net/if_vlan.c#L1132

jahonix

I love this kind of collaboration, really great!

jdillard

Nice work PiBa! And thanks for the lead jahonix!

I updated the ticket with the new info: https://redmine.pfsense.org/issues/7751

maverick_slo

Thanks guys!
This us why I prefer pfsense to other fw's… ;)

jahonix

@jared: I didn't do a thing despite remembering that I had this problem in the past myself.
And someone gave me a smite for it anyways. ;-)

I'd love to contribute more actively but my programming abilities are elsewhere (Crestron mainly).

maverick_slo

Resolved with todays snap!

Thanks guys!

Raul Ramos

Hi

My Lan is a parent interface of 2 Vlan's. When someone transfere something from internet on one of the Vlan's interface the Lan interface have the same bandwidth usage (if no one use Lan otherwise it sum the bandwidth). Ideally, in my case, should be the bandwidth used in Vlan not sum in the Parent interface.

Some stuff i can point is the rule from Vlan to internet have a limiter.

The double bandwidth is solved in Vlan's interfaces.