[38229] in North American Network Operators' Group
RE: mac-address accounting
daemon@ATHENA.MIT.EDU (Martin, Christian)
Fri Jun 1 09:50:42 2001
Message-ID: <94B9091E1149D411A45C00508BACEB359CDB89@entmail.gnilink.com>
From: "Martin, Christian" <cmartin@gnilink.net>
To: 'Simon Leinen' <simon@limmat.switch.ch>,
Alex Rubenstein <alex@nac.net>
Cc: nanog@merit.edu
Date: Fri, 1 Jun 2001 09:49:19 -0400
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Errors-To: owner-nanog-outgoing@merit.edu
I think these maybe the Cisco LOOP pulses sent out to detect link status.
Lemme check in the lab...
chris
> -----Original Message-----
> From: Simon Leinen [mailto:simon@limmat.switch.ch]
> Sent: Friday, June 01, 2001 8:47 AM
> To: Alex Rubenstein
> Cc: nanog@merit.edu
> Subject: Re: mac-address accounting
>
>
>
> >>>>> "ar" == Alex Rubenstein <alex@nac.net> writes:
> > core1.nyc#sho int g0/0/0 mac-accounting
> > GigabitEthernet0/0/0 to external peers and customers
> > Output (475 free)
> [...]
> > 0100.0c00.0000(13 ): 57198 packets, 37155973 bytes,
> last: 388ms ago
> [...]
> > core1.nyc#sho arp | inc 0100
> > core1.nyc#
>
> 01:00:0c is Cisco's Ethernet multicast address prefix.
> 01:00:0c:00:00:00 looks strange to me.
>
> The cisco-nsp mailing list had a query about this problem:
>
> http://puck.nether.net/lists/cisco-nsp/0318.html
>
> But I don't know whether this has been resolved. If I try outbound
> MAC accounting (usually I only use inbound MAC accounting at exchange
> points) on a 7206VXR running 12.0(17)S, everything looks fine.
>
> > All the others are valid, yet they are way, and I mean *way* under
> > the amounts that I know I am sending to that peer.
>
> (Maybe your Cisco multicasts all traffic out to the exchange point
> rather than send it to the correct peer - seems much more robust to
> me, although you might end up with heavy packet replication :-)
> --
> Simon Leinen simon@babar.switch.ch
> SWITCH
http://www.switch.ch/misc/leinen/
Computers hate being anthropomorphized.
