[32557] in North American Network Operators' Group
MACs on PAIX
daemon@ATHENA.MIT.EDU (Matt Hempel)
Tue Nov 28 14:29:26 2000
Message-ID: <3A240685.3DC4F241@globix.net>
Date: Tue, 28 Nov 2000 14:24:53 -0500
From: Matt Hempel <mhempel@globix.net>
MIME-Version: 1.0
To: nanog@merit.edu
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Errors-To: owner-nanog-outgoing@merit.edu
I'm using MAC accounting on our Fast E connection at the PAIX to do
per-peer traffic stats. It worked great until we put in a GSR. I don't
know why it worked before or if anything has changed since.
The stats aren't working now because the # of entries in the
MAC accounting table exceed 512 (a hard IOS limit). The majority of
these aren't in the ARP table ... they are inbound without translation
... just layer 2 noise.
It seems odd to me that there are this many distinct addresses on the
same shared
segment. Not to mention that the port isn't switched.
To wit:
0000.0000.0000(0 ): 110444951 packets, 27399M bytes, last: 80ms ago
0000.0003.0000(3 ): 9416 packets, 2738919 bytes, last: 455680ms ago
0000.037f.4129(20 ): 33 packets, 7700 bytes, last: 302129568ms ago
Pretty serious chunks of bandwidth.
There are a large group of these addresses that begin with 0000. --- are
these some sort of bridged translation? Can you think of any other
reason that so many MACs would appear on the same port?
--matt hempel