|
I've been watching errant traffic via tcpdump trying to track some unrelated
problems and have noticed there is a lot of broadcast traffic coming from
the active director.
The traffic all looks like this:
09:13:04.016297 IP 216.94.150.8.32848 > 224.0.0.81.8848: UDP, length 28
According to some archive posts, this is how Apache session information is
shared. I haven't dug deeper into the tcp traffic to figure out if this is
true.
These broadcasts occur every 2-6 seconds and aren't on a consistent
schedule. I have a dedicated set of interfaces for heartbeat information
(which I thought also shared the session information) and it looks like
this:
09:38:14.093733 IP 10.0.0.1.32847 > 10.0.0.2.ha-cluster: UDP, length 159
09:38:14.319831 IP 10.0.0.2.32807 > 10.0.0.1.ha-cluster: UDP, length 158
09:38:15.095778 IP 10.0.0.1.32847 > 10.0.0.2.ha-cluster: UDP, length 159
09:38:15.317917 IP 10.0.0.2.32807 > 10.0.0.1.ha-cluster: UDP, length 158
I get a pair of broadcasts once per second. I expect this as it is
configured that way.
The broadcast info to 224.0.0.81.8848 is not configured in ha.cf, and
neither director has mcast settings on any device.
So what is the information being broadcast on the external internet device?
I shouldn't be seeing _ANY_ broadcast packets over the external interface as
far as I'm concerned.
_________________________________
Dan Brown
zu.com communications inc.
|
