Linode Forum
https://forum.linode.com/

Explanation of periodic IPv6 traffic spikes
https://forum.linode.com/viewtopic.php?f=19&t=7751		 Page 1 of 1
Author:  emddudley [ Fri Sep 16, 2011 12:47 pm ]
Post subject:  Explanation of periodic IPv6 traffic spikes
Can anyone explain what these IPv6 traffic spikes are? I'm curious whether this is specific to my Linode.

Image
Author:  bjl [ Fri Sep 16, 2011 12:54 pm ]
Post subject: 
my node's IPv6 graph looks almost the same.
Author:  hybinet [ Fri Sep 16, 2011 1:06 pm ]
Post subject: 
Interesting. The "spikes" are around 160 bits per second, or roughly 20 bytes. A single IPv6 packet comes with a 40-byte header. So your spikes are not even half a header per second, not to mention the payload. Traffic of this sort won't even be visible on a public IPv4 address. Maybe it's Linode's networking equipment pinging your IP every once in a while to see if it's alive?
Author:  hoopycat [ Fri Sep 16, 2011 3:14 pm ]
Post subject: 
The Well-Known Intervals list indicates that it coincides with the default TCP keep-alive timer, but I don't think that's it. My gut is telling me that it looks like neighbor/router advertisements.

This, running for a couple hours, will probably find something:
Code:
$ tcpdump -n -i eth0 ip6 | tee /tmp/ip6-capture.txt


Note that it totals to 2.10 kB/day, which is low enough that the "spikes" might just be sampling artifacts, and it might not actually be a two-hour interval.
Author:  bjl [ Fri Sep 16, 2011 4:14 pm ]
Post subject: 
hoopycat wrote:
My gut is telling me that it looks like neighbor/router advertisements.


looks like that might be it, at least in my case. here's a small sample of what tcpdump is giving me:

Code:
13:07:15.893701 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:18.893800 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:21.893868 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:29.085970 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:32.086055 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:37.862081 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:46.166262 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:50.006377 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:54.194379 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:07:57.194519 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:00.194599 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:03.194624 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:06.194675 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:09.194722 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:12.194829 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:32.567099 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:35.567220 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:41.067282 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:44.895568 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:47.895425 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:50.895478 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:54.335509 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:08:57.335632 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:00.335596 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:03.335755 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:06.335857 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:21.336103 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:22.560391 IP6 2600:3c01::f03c:91ff:fe93:bd0c.56335 > 2001:1868:213:5::2.123: NTPv4, Client, length 48
13:09:22.562299 IP6 2001:1868:213:5::2.123 > 2600:3c01::f03c:91ff:fe93:bd0c.56335: NTPv4, Server, length 48
13:09:26.072127 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:27.570270 IP6 fe80::f03c:91ff:fe93:bd0c > fe80::1: ICMP6, neighbor solicitation, who has fe80::1, length 32
13:09:27.572352 IP6 fe80::1 > fe80::f03c:91ff:fe93:bd0c: ICMP6, neighbor advertisement, tgt is fe80::1, length 24
13:09:30.435994 IP6 fe80::ca4c:75ff:fef5:d63f > 2600:3c01::f03c:91ff:fe93:bd0c: ICMP6, neighbor solicitation, who has 2600:3c01::f03c:91ff:fe93:bd0c, length 32
13:09:30.436086 IP6 2600:3c01::f03c:91ff:fe93:bd0c > fe80::ca4c:75ff:fef5:d63f: ICMP6, neighbor advertisement, tgt is 2600:3c01::f03c:91ff:fe93:bd0c, length 24
13:09:32.576027 IP6 fe80::ca4c:75ff:fef5:d63f > fe80::f03c:91ff:fe93:bd0c: ICMP6, neighbor solicitation, who has fe80::f03c:91ff:fe93:bd0c, length 32
13:09:32.576094 IP6 fe80::f03c:91ff:fe93:bd0c > fe80::ca4c:75ff:fef5:d63f: ICMP6, neighbor advertisement, tgt is fe80::f03c:91ff:fe93:bd0c, length 24
13:09:34.976296 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:35.442236 IP6 fe80::f03c:91ff:fe93:bd0c > fe80::ca4c:75ff:fef5:d63f: ICMP6, neighbor solicitation, who has fe80::ca4c:75ff:fef5:d63f, length 32
13:09:35.444687 IP6 fe80::ca4c:75ff:fef5:d63f > fe80::f03c:91ff:fe93:bd0c: ICMP6, neighbor advertisement, tgt is fe80::ca4c:75ff:fef5:d63f, length 24
13:09:41.468428 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:45.149908 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:48.152529 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:55.200920 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:09:58.200744 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:10:02.520825 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64
13:10:26.917522 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64


My spikes tend to be on the "odd" numbered (local) hours.
Author:  hoopycat [ Fri Sep 16, 2011 7:52 pm ]
Post subject: 
So, an RA every 3 seconds... at 64 bytes, that's about 171 bits per second. That should push the baseline up higher than it is. It is not to/from one of your IPs (address-wise), so I suspect it isn't being counted and thus isn't what's causing the spikes.

(We do all realize the chart is not indicative of any sort of "problem", and so this is idle speculation over 2.10 kB/day, right?)
Author:  bjl [ Fri Sep 16, 2011 9:06 pm ]
Post subject: 
Yep. It doesn't bother me really. It's mostly all incoming. And I think, probably as does the OP, that it just looks strange on the graph. I guess I need to generate more IPv6 traffic to smooth things out. :D
Author:  mnordhoff [ Sat Sep 17, 2011 12:30 am ]
Post subject: 
You're using an IPv6 NTP server (presumably from the NTP pool) -- that's a start!
Author:  emddudley [ Sun Sep 18, 2011 10:55 pm ]
Post subject: 
Thanks all for the responses. I was just curious.
Page 1 of 1 All times are UTC-04:00
Powered by phpBB® Forum Software © phpBB Group
http://www.phpbb.com/