LVS
lvs-users
Google
 
Web LinuxVirtualServer.org

tcpdump for LVS

To: "LinuxVirtualServer.org users mailing list." <lvs-users@xxxxxxxxxxxxxxxxxxxxxx>
Subject: tcpdump for LVS
From: Jacob Coby <jcoby@xxxxxxxxxxxxxxx>
Date: Tue, 27 Sep 2005 11:49:29 -0400
Is there anything special I need to do to get tcpdump to work with LVS in DR mode? I've been trying to chase down this problem I've been having with connections being opened, but never closed, and I want to make sure I'm capturing the best data possible.

Right now, I'm doing tcpdump "port 80 and ether dst [director mac] and src host [offending ip]". If I don't include the director's mac restriction, it logs the duplicate (resent) packets to the real server.

So far, I've found:

- Most connections are 5-packets long that send small amounts of data (~600 bytes) (seems normal for a website)
- Several RESET packets.
- the idletime max from tcptrace seems very, very high: idletime max: 328238.1 ms. I've seen it over 2 million ms.

If someone would be willing to help, I have tcpdumps and tcptrace outputs that include the problem connections along with normal connection data. I just don't know how to analyze it.

Thanks,
--
-Jacob

<Prev in Thread] Current Thread [Next in Thread>