I have been trying accounting on a Linux router.
The router has 2 interfaces, and is routing to a class C network from Internet.
I have set up accounting to track traffic to/from each host on the class C:
ipfwadm -A out -a -W eth1 -D 195.224.175.65
ipfwadm -A in -a -W eth1 -S 195.224.175.65
ipfwadm -A out -a -W eth1 -D 195.224.175.66
ipfwadm -A in -a -W eth1 -S 195.224.175.66
ipfwadm -A out -a -W eth1 -D 195.224.175.67
ipfwadm -A in -a -W eth1 -S 195.224.175.67
ipfwadm -A out -a -W eth1 -D 195.224.175.68
ipfwadm -A in -a -W eth1 -S 195.224.175.68
ipfwadm -A out -a -W eth1 -D 195.224.175.69
ipfwadm -A in -a -W eth1 -S 195.224.175.69
ipfwadm -A out -a -W eth1 -D 195.224.175.70
etc.
At present I have only got one host - 195.224.175.65 active, however the accounting
data is as follows:
2578 667K out all anywhere 195.224.175.65 n/a
2605 253K in all 195.224.175.65 anywhere n/a
1 46 out all anywhere 195.224.175.66 n/a
0 0 in all 195.224.175.66 anywhere n/a
1 46 out all anywhere 195.224.175.67 n/a
0 0 in all 195.224.175.67 anywhere n/a
1 46 out all anywhere 195.224.175.68 n/a
0 0 in all 195.224.175.68 anywhere n/a
1 46 out all anywhere 195.224.175.69 n/a
0 0 in all 195.224.175.69 anywhere n/a
1 46 out all anywhere 195.224.175.70 n/a
0 0 in all 195.224.175.70 anywhere n/a
1 46 out all anywhere 195.224.175.71 n/a
0 0 in all 195.224.175.71 anywhere n/a
Can anyone explain what the packet sent to each non-existent host could be?
TIA
Derek Sims
[EMAIL PROTECTED]
http://www.interdart.co.uk/
Phone: 01442 876692 Fax: 01442 384554
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to [EMAIL PROTECTED]
