Take the 2-minute tour ×

Situation: Server A is receiving network traffic sent from server B to server C. Server B & C send over MySQL dumps. Quite some traffic. For some reason the interface on server A is measuring this traffic. It's not doing anything with it tho, it just sees it.

When I run tcpdump I see that the source and target of the mysql packets are server B and server C. Never server A.

12:52:44.482026 IP $IP_server_B.3306 > $IP_server_A.38662: Flags [.], seq 15905879:15911671, ack 8910, win 62, options [nop,nop,TS val 237711415 ecr 331318504], length 5792

I've double checked the script that send over the dump, the IP of server A is nowhere in that. I've checked if there are IP conflicts - none. The interfaces on all 3 machines have different MAC adresses (just wanted to rule out everything). I can reproduce the behavior on these machines 10 out of 10 times.

All 3 machines are virtual CentOS 6 x64 installations. Server A & B are in the same subnet, server C is in a completely different datacenter and network. Note: Server A & B are in the same subnet, but are not running on the same physical hypervisor.

So.. the question is: how on earth does server A see that traffic?

share|improve this question
Have you tried checking the ARP caches on the servers and any intermediate switches? Is there any chance you have stale DNS records? –  kce Feb 18 '13 at 5:03
Was this a cleanup mistake or is it actually sending them to IP_server_A? $IP_server_B.3306 > $IP_server_A.38662 –  gnp Jul 10 '13 at 20:06
add comment

1 Answer

If the Server A and B are connected to a simple Hub instead of a smarter Switch, all traffic will be broadcasted to all connected machines. Then its up to the machines to decide if this traffic they receive is for them or if they should just ignore it. Tcpdump, by default, puts your interface into promiscous mode, which means it doesnt ignore any traffic, not even the one which isn't addressed to it. That's why with Tcpdump you can see all the traffic on your hub.

share|improve this answer
No hub tho, expensive managed switching equipment... –  Johan Kooijman Feb 16 '13 at 14:25
Then I don't know... possibly just the configuration of the switch then. –  mauro.stettler Feb 16 '13 at 14:27
Thought about that too. But since these are virtual boxes and no other virtual box on the netwerk (even on the same physical machine) doesn't see the same network traffic, I think I could rule out the switch. –  Johan Kooijman Feb 16 '13 at 14:33
add comment

Your Answer


