 |
Linode Forum
Linode Community Forums
|
| Author |
Message |
emddudley
Joined: 16 Sep 2011
Posts: 2
|
| Posted: Fri Sep 16, 2011 11:47 am Post subject: Explanation of periodic IPv6 traffic spikes |
|
|
Can anyone explain what these IPv6 traffic spikes are? I'm curious whether this is specific to my Linode.
|
|
| Back to top |
|
bjl
Joined: 31 Aug 2009
Posts: 56
|
| Posted: Fri Sep 16, 2011 11:54 am Post subject: |
|
|
| my node's IPv6 graph looks almost the same. |
|
| Back to top |
|
hybinet
Joined: 02 May 2008
Posts: 1058
|
| Posted: Fri Sep 16, 2011 12:06 pm Post subject: |
|
|
| Interesting. The "spikes" are around 160 bits per second, or roughly 20 bytes. A single IPv6 packet comes with a 40-byte header. So your spikes are not even half a header per second, not to mention the payload. Traffic of this sort won't even be visible on a public IPv4 address. Maybe it's Linode's networking equipment pinging your IP every once in a while to see if it's alive? |
|
| Back to top |
|
hoopycat
Joined: 30 Aug 2008
Posts: 1294
Location: Rochester, New York
|
| Posted: Fri Sep 16, 2011 2:14 pm Post subject: |
|
|
The Well-Known Intervals list indicates that it coincides with the default TCP keep-alive timer, but I don't think that's it. My gut is telling me that it looks like neighbor/router advertisements.
This, running for a couple hours, will probably find something:
Code: $ tcpdump -n -i eth0 ip6 | tee /tmp/ip6-capture.txt
Note that it totals to 2.10 kB/day, which is low enough that the "spikes" might just be sampling artifacts, and it might not actually be a two-hour interval. |
|
| Back to top |
|
bjl
Joined: 31 Aug 2009
Posts: 56
|
| Posted: Fri Sep 16, 2011 3:14 pm Post subject: |
|
|
hoopycat wrote: My gut is telling me that it looks like neighbor/router advertisements.
looks like that might be it, at least in my case. here's a small sample of what tcpdump is giving me:
Code: 13:07:15.893701 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:18.893800 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:21.893868 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:29.085970 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:32.086055 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:37.862081 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:46.166262 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:50.006377 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:54.194379 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:57.194519 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:00.194599 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:03.194624 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:06.194675 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:09.194722 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:12.194829 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:32.567099 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:35.567220 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:41.067282 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:44.895568 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:47.895425 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:50.895478 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:54.335509 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:57.335632 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:00.335596 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:03.335755 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:06.335857 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:21.336103 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:22.560391 IP6 2600:3c01::f03c:91ff:fe93:bd0c.56335 > 2001:1868:213:5::2.123: NTPv4, Client, length 48
13:09:22.562299 IP6 2001:1868:213:5::2.123 > 2600:3c01::f03c:91ff:fe93:bd0c.56335: NTPv4, Server, length 48
13:09:26.072127 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:27.570270 IP6 fe80::f03c:91ff:fe93:bd0c > fe80::1: ICMP6, neighbor solicitation, who has fe80::1, length 32
13:09:27.572352 IP6 fe80::1 > fe80::f03c:91ff:fe93:bd0c: ICMP6, neighbor advertisement, tgt is fe80::1, length 24
13:09:30.435994 IP6 fe80::ca4c:75ff:fef5:d63f > 2600:3c01::f03c:91ff:fe93:bd0c: ICMP6, neighbor solicitation, who has 2600:3c01::f03c:91ff:fe93:bd0c, length 32
13:09:30.436086 IP6 2600:3c01::f03c:91ff:fe93:bd0c > fe80::ca4c:75ff:fef5:d63f: ICMP6, neighbor advertisement, tgt is 2600:3c01::f03c:91ff:fe93:bd0c, length 24
13:09:32.576027 IP6 fe80::ca4c:75ff:fef5:d63f > fe80::f03c:91ff:fe93:bd0c: ICMP6, neighbor solicitation, who has fe80::f03c:91ff:fe93:bd0c, length 32
13:09:32.576094 IP6 fe80::f03c:91ff:fe93:bd0c > fe80::ca4c:75ff:fef5:d63f: ICMP6, neighbor advertisement, tgt is fe80::f03c:91ff:fe93:bd0c, length 24
13:09:34.976296 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:35.442236 IP6 fe80::f03c:91ff:fe93:bd0c > fe80::ca4c:75ff:fef5:d63f: ICMP6, neighbor solicitation, who has fe80::ca4c:75ff:fef5:d63f, length 32
13:09:35.444687 IP6 fe80::ca4c:75ff:fef5:d63f > fe80::f03c:91ff:fe93:bd0c: ICMP6, neighbor advertisement, tgt is fe80::ca4c:75ff:fef5:d63f, length 24
13:09:41.468428 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:45.149908 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:48.152529 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:55.200920 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:58.200744 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:10:02.520825 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:10:26.917522 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
My spikes tend to be on the "odd" numbered (local) hours. |
|
| Back to top |
|
hoopycat
Joined: 30 Aug 2008
Posts: 1294
Location: Rochester, New York
|
| Posted: Fri Sep 16, 2011 6:52 pm Post subject: |
|
|
So, an RA every 3 seconds... at 64 bytes, that's about 171 bits per second. That should push the baseline up higher than it is. It is not to/from one of your IPs (address-wise), so I suspect it isn't being counted and thus isn't what's causing the spikes.
(We do all realize the chart is not indicative of any sort of "problem", and so this is idle speculation over 2.10 kB/day, right?) |
|
| Back to top |
|
bjl
Joined: 31 Aug 2009
Posts: 56
|
| Posted: Fri Sep 16, 2011 8:06 pm Post subject: |
|
|
| Yep. It doesn't bother me really. It's mostly all incoming. And I think, probably as does the OP, that it just looks strange on the graph. I guess I need to generate more IPv6 traffic to smooth things out. :D |
|
| Back to top |
|
mnordhoff
Joined: 03 May 2008
Posts: 451
|
| Posted: Fri Sep 16, 2011 11:30 pm Post subject: |
|
|
| You're using an IPv6 NTP server (presumably from the NTP pool) -- that's a start! |
|
| Back to top |
|
emddudley
Joined: 16 Sep 2011
Posts: 2
|
| Posted: Sun Sep 18, 2011 9:55 pm Post subject: |
|
|
| Thanks all for the responses. I was just curious. |
|
| Back to top |
|
| |
|