Weird Traffic in Status > Monitoring

Rico

I found a strange one.
SG-5100, WAN igb0, LAN igb1, DMZ ix0, WAN2 ix1

So I'm sourcing upstream traffic from the local pfSense console with
curl --interface ix1 -T /dev/random <target>
pfSense dashboard traffic widget looks Okay, WAN traffic is almost idle, WAN2 upstream traffic is maxed out.
Now switching to
Status > Monitoring > Left Axis [Category] Traffic [Graph] WAN2 => looks Okay
but
Status > Monitoring > Left Axis [Category] Traffic [Graph] WAN => is showing the exact same upstream traffic like WAN2 for the curl time frame!

This does not happen with traffic sourcing from LAN or DMZ and policy route out WAN2 or using fetch at the local pfSense console.

Any idea what is happening there?

-Rico

stephenw10

Hmm, curious.

Do you see it on the correct interface in the Traffic Graphs at the time?

Do you see the values on the interface data totals duplicated like that?

Have you re-assigned that interface at all? We have seen situations in the past where you might have an old gateway for example still on the original interface and pulling stats.

Steve

Rico

It's not showing in Status > Traffic Graph > WAN
I try to reproduce this later at home...

-Rico

Rico

Just checked one of my other SG-5100s with MultiWAN and it is the exact same behavior. I don't think it is hardware/interface related, but checking with my VMware lab later at home.

-Rico

Rico

Same in my VMware lab. And yes, it is also duplicated in the Interface Statistics - but only Bytes Out / Packets Out.

Command used is
curl --interface em2 -T /dev/random ftp://speedtest.tele2.net/upload/

Feels a bit like hitting this again somehow: https://forum.netgate.com/topic/152067/diag_traceroute/8

-Rico

Rico

Yeah it's the same, WAN2 doesnt show any single state besides the gateway monitoring (ICMP) while curl is running.

-Rico

stephenw10

Hmm, that does seem likely to be related....

Just to confirm, you are seeing this in 2.4.5p1? Can you test in 2.5?

Steve

Rico

Yes seeing this in 2.4.5-p1, already tested with 2.5.0.a.20200911.0650 yesterday and it's the exact same.

-Rico