Extraneous Host IPs show up on WAN graph page
-
2.0-BETA4 (i386)
built on Thu Nov 18 19:02:37 EST 2010
nanobsd (1g)There are a few problems with this screenshot.
1. x.x.225.178 is the address of an internal interface (gateway to x.x.225.177). There are no WAN rules allowing access to it, and tcpdump on WAN filtering for that host shows no packet, so that IP should not show up on this page at all.
2. x.x.224.55 appears twice. Obviously this should not be.
3. While the top 2 entries show changing bandwidth values (and disappear when the address is idle), the bottom two are static and don't disappear until the page is reloaded.These dead entries don't appear right away when the graph is loaded in the browser, but after some time, like an hour or so. Obviously this isn't a critical issue, but it needs to be fixed. I searched the Issues page on redmine but didn't see anything related, so should I open a new ticket?
-
I haven't seen this exact issue, but I've attempted to use the Traffic Graph recently to troubleshoot some bandwidth-hog problems and found that it seemed really random, IPs kept popping on and off the graph too fast to read and the Bit/sec numbers were often not high enough among the few IPs listed to add up to the overall throughput shown on the graph. It's a very cool idea but didn't help me troubleshoot this customer (I think they're running a snapshot from almost that same day) who has consistent internet slowdowns on Tuesday afternoons each week; I was hoping it would more easily show me bandwidth hogs in real time. Also, allowing a reverse DNS lookup option to be turned on would be very helpful rather than manually having to reverse each IP to see what's hammering, assuming they are accurate.
So I love the concept, but when it comes down to looking at individual hosts, the info seems less than accurate sometimes (but I can't exactly quantify it). I'd love to see some historical info where hosts don't disappear right away (they can grey-out when not transmitting, just not disappear), at least not for several more seconds (I wouldn't mind them sticking around forever and being shown in order of most bandwidth used since chart opened or most-throughput-now, or optionally both, choosable). Obviously what's there is better than nothing and better than a lot of what's out there already, but I'm brainstorming and dreaming :-)