Hello.
I have configured my FreeBSD x64 10.2-p7 box to save pflog logs directly onto a NFS mount on a Debian box.
Even though I have had it running for two days that saved a total of 4GBytes of pflog data in
With a constant of 2MByte/s bandwidth which in no way corresponds to the 4GBytes of data that got saved during this time period.
The relevant FreeBSD (default) settings that I enabled for the NFS mount were:
/etc/rc.conf
/etc/newsyslog.conf
/etc/fstab
The settings on the Debian 8 server are:
/etc/fstab
/etc/exports
Here's an excerpt of
As it can be seen there's a bunch of suspicious getattr fh Unknown/0100070202002402000000006E7815A5CD91450C8E83479F732ECD8703002402 commands in the output.
I should in no way be seeing such traffic with NFS (Especially not input! Since the box is supposed to send data). Does this mean some misconfiguration on my part? Any recommendations (given that I just run with the defaults)?
Thank you.
I have configured my FreeBSD x64 10.2-p7 box to save pflog logs directly onto a NFS mount on a Debian box.
Even though I have had it running for two days that saved a total of 4GBytes of pflog data in
systat -if I see a total of over 200GBytes of network traffic on the dedicated interface for NFS. (Most importantly as input, which is odd considering the box is supposed to send data)With a constant of 2MByte/s bandwidth which in no way corresponds to the 4GBytes of data that got saved during this time period.
Code:
bce3.101 in 2.015 MB/s 4.295 MB/s 226.455 GB
out 0.148 MB/s 0.314 MB/s 17.048 GBThe relevant FreeBSD (default) settings that I enabled for the NFS mount were:
/etc/rc.conf
Code:
nfs_client_enable="YES"
pflog_enable="YES"
pflog_logfile="/mnt/r1/pflog"
pflog_flags="'tcp'"/etc/newsyslog.conf
Code:
/mnt/r1/pflog 600 * * @T00 B /var/run/pflogd.pid/etc/fstab
Code:
debian-server:/mnt/hdd1-raid10/log/r1 /mnt/r1 nfs rw 0 0 $ nfsstat -m
Code:
debian-server:/mnt/hdd1-raid10/log/r1 on /mnt/r1
nfsv3,tcp,resvport,hard,cto,lockd,sec=sys,acdirmin=3,acdirmax=60,acregmin=5,acregmax=60,nametimeo=60,negnametimeo=60,rsize=65536,wsize=65536,readdirsize=8192,readahead=1,wcommitsize=16777216,timeout=120,retrans=2The settings on the Debian 8 server are:
/etc/fstab
Code:
/dev/disk/by-uuid/6e7815a5-cd91-450c-8e83-479f732ecd87 /mnt/hdd1-raid10 ext4 defaults 0 1/etc/exports
Code:
/mnt/hdd1-raid10/log/r1 freebsd-client(rw,no_root_squash,subtree_check)Here's an excerpt of
tcpdump -i bce3.101 (that ran for 1s) on the interface used for NFS on my FreeBSD box:
Code:
22:01:48.536429 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1644984:1646432, ack 79221, win 32885, options [nop,nop,TS val 708545853 ecr 1016368078], length 1448
22:01:48.536433 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1646432:1647880, ack 79221, win 32885, options [nop,nop,TS val 708545853 ecr 1016368078], length 1448
22:01:48.536438 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1647880, win 1857, options [nop,nop,TS val 1016368079 ecr 708545853], length 0
22:01:48.536471 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1647880:1649328, ack 79221, win 32885, options [nop,nop,TS val 708545853 ecr 1016368078], length 1448
22:01:48.536475 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1649328:1650776, ack 79221, win 32885, options [nop,nop,TS val 708545853 ecr 1016368078], length 1448
22:01:48.536480 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1650776, win 1834, options [nop,nop,TS val 1016368079 ecr 708545853], length 0
22:01:48.536482 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1650776:1652224, ack 79221, win 32885, options [nop,nop,TS val 708545853 ecr 1016368078], length 1448
22:01:48.536485 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1652224:1653672, ack 79221, win 32885, options [nop,nop,TS val 708545853 ecr 1016368078], length 1448
22:01:48.536491 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1653672, win 1811, options [nop,nop,TS val 1016368079 ecr 708545853], length 0
22:01:48.536492 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1653672:1655120, ack 79221, win 32885, options [nop,nop,TS val 708545853 ecr 1016368078], length 1448
22:01:48.536496 IP debian-server.2049 > freebsd-client.896: Flags [P.], seq 1655120:1655460, ack 79221, win 32885, options [nop,nop,TS val 708545853 ecr 1016368078], length 340
22:01:48.536504 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1655460, win 2060, options [nop,nop,TS val 1016368079 ecr 708545853], length 0
22:01:48.536545 IP freebsd-client.549477231 > debian-server.2049: 1160 write fh Unknown/0100070202002402000000006E7815A5CD91450C8E83479F732ECD8703002402 1024 (1024) bytes @ 2195751656
22:01:48.536662 IP debian-server.2049 > freebsd-client.549477231: reply ok 136 write [|nfs]
22:01:48.536690 IP freebsd-client.549477232 > debian-server.2049: 128 commit fh Unknown/0100070202002402000000006E7815A5CD91450C8E83479F732ECD8703002402 1024 bytes @ 2195751656
22:01:48.537430 IP debian-server.2049 > freebsd-client.549477232: reply ok 128 commit
22:01:48.537466 IP freebsd-client.549477233 > debian-server.2049: 116 getattr fh Unknown/0100070202002402000000006E7815A5CD91450C8E83479F732ECD8703002402
22:01:48.537554 IP debian-server.2049 > freebsd-client.549477233: reply ok 112 getattr REG 600 ids 0/0 sz 2195752680
22:01:48.537573 IP freebsd-client.549477234 > debian-server.2049: 128 read fh Unknown/0100070202002402000000006E7815A5CD91450C8E83479F732ECD8703002402 35560 bytes @ 2195718144
22:01:48.537736 IP debian-server.2049 > freebsd-client.549477234: reply ok 1444 read
22:01:48.537742 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1657296:1658744, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537749 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1658744, win 2038, options [nop,nop,TS val 1016368080 ecr 708545853], length 0
22:01:48.537751 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1658744:1660192, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537755 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1660192:1661640, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537761 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1661640, win 2015, options [nop,nop,TS val 1016368080 ecr 708545853], length 0
22:01:48.537763 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1661640:1663088, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537766 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1663088:1664536, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537771 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1664536, win 1992, options [nop,nop,TS val 1016368080 ecr 708545853], length 0
22:01:48.537810 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1664536:1665984, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537814 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1665984:1667432, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537819 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1667432, win 1970, options [nop,nop,TS val 1016368080 ecr 708545853], length 0
22:01:48.537821 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1667432:1668880, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537825 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1668880:1670328, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537830 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1670328, win 1947, options [nop,nop,TS val 1016368080 ecr 708545853], length 0
22:01:48.537831 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1670328:1671776, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537835 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1671776:1673224, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537840 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1673224, win 1925, options [nop,nop,TS val 1016368080 ecr 708545853], length 0
22:01:48.537884 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1673224:1674672, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537888 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1674672:1676120, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537893 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1676120, win 1902, options [nop,nop,TS val 1016368080 ecr 708545853], length 0
22:01:48.537895 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1676120:1677568, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537898 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1677568:1679016, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537903 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1679016, win 1879, options [nop,nop,TS val 1016368080 ecr 708545853], length 0
22:01:48.537905 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1679016:1680464, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537908 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1680464:1681912, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537913 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1681912, win 1857, options [nop,nop,TS val 1016368080 ecr 708545853], length 0
22:01:48.537957 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1681912:1683360, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537961 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1683360:1684808, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537966 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1684808, win 1834, options [nop,nop,TS val 1016368080 ecr 708545853], length 0
22:01:48.537968 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1684808:1686256, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537971 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1686256:1687704, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537976 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1687704, win 1811, options [nop,nop,TS val 1016368080 ecr 708545853], length 0
22:01:48.537978 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1687704:1689152, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1448
22:01:48.537982 IP debian-server.2049 > freebsd-client.896: Flags [P.], seq 1689152:1690516, ack 80769, win 32885, options [nop,nop,TS val 708545853 ecr 1016368080], length 1364
22:01:48.537988 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1690516, win 2060, options [nop,nop,TS val 1016368080 ecr 708545853], length 0
22:01:48.538022 IP freebsd-client.549477235 > debian-server.2049: 1160 write fh Unknown/0100070202002402000000006E7815A5CD91450C8E83479F732ECD8703002402 1024 (1024) bytes @ 2195752680
22:01:48.538149 IP debian-server.2049 > freebsd-client.549477235: reply ok 136 write [|nfs]
22:01:48.538197 IP freebsd-client.549477236 > debian-server.2049: 128 commit fh Unknown/0100070202002402000000006E7815A5CD91450C8E83479F732ECD8703002402 1024 bytes @ 2195752680
22:01:48.538926 IP debian-server.2049 > freebsd-client.549477236: reply ok 128 commit
22:01:48.538960 IP freebsd-client.549477237 > debian-server.2049: 116 getattr fh Unknown/0100070202002402000000006E7815A5CD91450C8E83479F732ECD8703002402
22:01:48.539067 IP debian-server.2049 > freebsd-client.549477237: reply ok 112 getattr REG 600 ids 0/0 sz 2195753704
22:01:48.539088 IP freebsd-client.549477238 > debian-server.2049: 128 read fh Unknown/0100070202002402000000006E7815A5CD91450C8E83479F732ECD8703002402 36584 bytes @ 2195718144
22:01:48.539298 IP debian-server.2049 > freebsd-client.549477238: reply ok 1444 read
22:01:48.539305 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1692352:1693800, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539311 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1693800, win 2038, options [nop,nop,TS val 1016368082 ecr 708545854], length 0
22:01:48.539313 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1693800:1695248, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539317 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1695248:1696696, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539323 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1696696, win 2015, options [nop,nop,TS val 1016368082 ecr 708545854], length 0
22:01:48.539325 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1696696:1698144, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539328 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1698144:1699592, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539333 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1699592, win 1992, options [nop,nop,TS val 1016368082 ecr 708545854], length 0
22:01:48.539372 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1699592:1701040, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539375 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1701040:1702488, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539381 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1702488, win 1970, options [nop,nop,TS val 1016368082 ecr 708545854], length 0
22:01:48.539383 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1702488:1703936, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539386 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1703936:1705384, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539392 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1705384, win 1947, options [nop,nop,TS val 1016368082 ecr 708545854], length 0
22:01:48.539393 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1705384:1706832, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539397 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1706832:1708280, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539402 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1708280, win 1925, options [nop,nop,TS val 1016368082 ecr 708545854], length 0
22:01:48.539446 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1708280:1709728, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539450 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1709728:1711176, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539455 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1711176, win 1902, options [nop,nop,TS val 1016368082 ecr 708545854], length 0
22:01:48.539457 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1711176:1712624, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539460 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1712624:1714072, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539465 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1714072, win 1879, options [nop,nop,TS val 1016368082 ecr 708545854], length 0
22:01:48.539467 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1714072:1715520, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539470 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1715520:1716968, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539477 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1716968, win 1857, options [nop,nop,TS val 1016368082 ecr 708545854], length 0
22:01:48.539520 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1716968:1718416, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539525 IP debian-server.2049 > freebsd-client.896: Flags [.], seq 1718416:1719864, ack 82317, win 32885, options [nop,nop,TS val 708545854 ecr 1016368081], length 1448
22:01:48.539531 IP freebsd-client.896 > debian-server.2049: Flags [.], ack 1719864, win 1834, options [nop,nop,TS val 1016368082 ecr 708545854], length 0
2202 packets captured
2683 packets received by filterAs it can be seen there's a bunch of suspicious getattr fh Unknown/0100070202002402000000006E7815A5CD91450C8E83479F732ECD8703002402 commands in the output.
I should in no way be seeing such traffic with NFS (Especially not input! Since the box is supposed to send data). Does this mean some misconfiguration on my part? Any recommendations (given that I just run with the defaults)?
Thank you.
Last edited by a moderator: