Re: [tlug] Slooooooow down: logs, smartctl, DNS?

[Mario De Tore <mariod410@example.com>]

On Sun, Jan 16, 2011 at 8:05 PM, Dave M G <dave@example.com> wrote:
> Christian, Mario,
>
> Thank you for responding.
>
> I am going to try Christian's suggestions for debugging and I'll report
> back here what I find.
>
> In the meantime, though, Mario requested I make the capture.cap file
> that I created available, so I did. You can download it here:
>
> http://autotelic.com/capture.cap
>
> It's 116 MB, so that's a hefty download. I'll leave it up there until I
> get this issue resolved.
>
> --
> Dave M G
>

Well, a quick look didn't show anything out of the ordinary.  The vast
majority of the traffic was SSH (as to be expected based on the setup
you described).  About nine minutes in there was a handful of
audioscrobbler-related DNS lookups. I didn't notice any obvious
network health issues (excessive TCP fragementation, broadcast storms,
etc).

One odd thing though - the NFS traffic keeps crashing my version of
Wireshark (v1.2.1).  Wireshark has always been buggy when it comes to
NFS though...

I'll take a closer look tomorrow, but nothing is jumping out at me.


mario@example.com:~# tshark -R "dns" -r capture.cap
  1   0.000000 fe80::20a:79ff:fe98:dded -> ff02::fb     MDNS Standard
query PTR _daap._tcp.local, "QM" question
  2   0.000081  192.168.0.4 -> 224.0.0.251  MDNS Standard query PTR
_daap._tcp.local, "QM" question
  3  32.031170 fe80::20a:79ff:fe98:dded -> ff02::fb     MDNS Standard
query PTR _daap._tcp.local, "QM" question
  4  32.031269  192.168.0.4 -> 224.0.0.251  MDNS Standard query PTR
_daap._tcp.local, "QM" question
  5  96.095670 fe80::20a:79ff:fe98:dded -> ff02::fb     MDNS Standard
query PTR _daap._tcp.local, "QM" question
  6  96.095760  192.168.0.4 -> 224.0.0.251  MDNS Standard query PTR
_daap._tcp.local, "QM" question
  7 224.206686 fe80::20a:79ff:fe98:dded -> ff02::fb     MDNS Standard
query PTR _daap._tcp.local, "QM" question
  8 224.206787  192.168.0.4 -> 224.0.0.251  MDNS Standard query PTR
_daap._tcp.local, "QM" question
  9 480.337822 fe80::20a:79ff:fe98:dded -> ff02::fb     MDNS Standard
query PTR _daap._tcp.local, "QM" question
 10 480.337916  192.168.0.4 -> 224.0.0.251  MDNS Standard query PTR
_daap._tcp.local, "QM" question
 11 529.321371  192.168.0.4 -> 208.67.222.222 DNS Standard query A
post2.audioscrobbler.com
 12 529.435818 208.67.222.222 -> 192.168.0.4  DNS Standard query
response CNAME post2.glb.audioscrobbler.com A 195.24.232.208 A
195.24.232.208
 13 529.439696  192.168.0.4 -> 208.67.222.222 DNS Standard query A
post.audioscrobbler.com
 14 529.554540 208.67.222.222 -> 192.168.0.4  DNS Standard query
response CNAME post.glb.audioscrobbler.com A 195.24.232.207 A
195.24.232.207
mario@example.com:~# host 208.67.222.222
222.222.67.208.in-addr.arpa domain name pointer resolver1.opendns.com.


mario@example.com:~# tshark -r capture.cap -z io,phs -q

===================================================================
Protocol Hierarchy Statistics
Filter: frame

frame                                    frames:212833 bytes:113236630
  eth                                    frames:212833 bytes:113236630
    ip                                   frames:212750 bytes:113220951
      tcp                                frames:212057 bytes:113011371
        ssh                              frames:122497 bytes:97876978
        rpc                              frames:40721 bytes:11933362
          nfs                            frames:40721 bytes:11933362
            rpc                          frames:7 bytes:7610
              nfs                        frames:7 bytes:7610
                rpc                      frames:4 bytes:6056
                  nfs                    frames:4 bytes:6056
                    rpc                  frames:4 bytes:6056
                      nfs                frames:4 bytes:6056
                        rpc              frames:4 bytes:6056
                          nfs            frames:4 bytes:6056
                            rpc          frames:4 bytes:6056
                              nfs        frames:4 bytes:6056
                                rpc      frames:2 bytes:3028
                                ...nfs   frames:2 bytes:3028
        tcp.segments                     frames:14 bytes:3671
          rpc                            frames:6 bytes:2668
            nfs                          frames:6 bytes:2668
              rpc                        frames:1 bytes:682
                nfs                      frames:1 bytes:682
                  rpc                    frames:1 bytes:682
                    nfs                  frames:1 bytes:682
          http                           frames:8 bytes:1003
            data-text-lines              frames:8 bytes:1003
        stun2                            frames:3499 bytes:545790
          data                           frames:3499 bytes:545790
        data                             frames:3 bytes:1922
      udp                                frames:640 bytes:205440
        nbdgm                            frames:10 bytes:2492
          smb                            frames:10 bytes:2492
            mailslot                     frames:10 bytes:2492
              browser                    frames:10 bytes:2492
        dns                              frames:9 bytes:825
        data                             frames:80 bytes:14720
        http                             frames:494 bytes:173167
        ntp                              frames:24 bytes:2160
        bootp                            frames:20 bytes:11800
        nbns                             frames:3 bytes:276
      igmp                               frames:39 bytes:1976
      icmp                               frames:14 bytes:2164
    ipv6                                 frames:43 bytes:13549
      udp                                frames:43 bytes:13549
        dns                              frames:5 bytes:480
        http                             frames:24 bytes:10983
        dhcpv6                           frames:14 bytes:2086
    arp                                  frames:40 bytes:2130
===================================================================