Problem with Network Interface - Interface in promiscue mode

SUSE Linux Enterprise Server SLES Networking
1

Hi Guru of Linux. I am using a Server how a monitoring equipment:

[HTML]
probe:~ # sar -n DEV 1
Linux 2.6.32.12-0.7-default (lav1) 01/16/2013 x86_64

12:52:19 PM IFACE rxpck/s txpck/s rxkB/s txkB/s rxcmp/s txcmp/s rxmcst/s
12:52:20 PM lo 87.00 87.00 46.15 46.15 0.00 0.00 0.00
12:52:20 PM eth4 163838.00 0.00 32331.13 0.00 0.00 0.00 0.00
12:52:20 PM eth7 308229.00 0.00 193079.61 0.00 0.00 0.00 0.00
12:52:20 PM eth5 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:20 PM eth6 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:20 PM eth0 3.00 0.00 0.26 0.00 0.00 0.00 0.00
12:52:20 PM eth1 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:20 PM eth2 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:20 PM eth3 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:20 PM eth0.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:20 PM eth0.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:20 PM eth1.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:20 PM eth1.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:20 PM eth2.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:20 PM eth2.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:20 PM eth3.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:20 PM eth3.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:20 PM eth4.2517 82528.00 0.00 15271.60 0.00 0.00 0.00 0.00
12:52:20 PM eth4.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:20 PM eth5.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:20 PM eth5.2518 12533.00 0.00 2277.89 0.00 0.00 0.00 0.00
12:52:20 PM eth6.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:20 PM eth6.2518 1.00 0.00 0.07 0.00 0.00 0.00 1.00
12:52:20 PM eth7.2517 151998.00 0.00 92767.46 0.00 0.00 0.00 0.00
12:52:20 PM eth7.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00

12:52:20 PM IFACE rxpck/s txpck/s rxkB/s txkB/s rxcmp/s txcmp/s rxmcst/s
12:52:21 PM lo 144.00 144.00 78.21 78.21 0.00 0.00 0.00
12:52:21 PM eth4 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth7 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth5 25132.00 0.00 4829.46 0.00 0.00 0.00 0.00
12:52:21 PM eth6 1.00 0.00 0.08 0.00 0.00 0.00 1.00
12:52:21 PM eth0 2.00 2.00 0.13 2.54 0.00 0.00 0.00
12:52:21 PM eth1 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth2 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth3 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth0.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth0.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth1.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth1.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth2.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth2.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth3.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth3.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth4.2517 81521.00 0.00 15201.78 0.00 0.00 0.00 1.00
12:52:21 PM eth4.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth5.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth5.2518 11809.00 0.00 2131.78 0.00 0.00 0.00 0.00
12:52:21 PM eth6.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth6.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:21 PM eth7.2517 147471.00 0.00 88237.93 0.00 0.00 0.00 0.00
12:52:21 PM eth7.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00

12:52:21 PM IFACE rxpck/s txpck/s rxkB/s txkB/s rxcmp/s txcmp/s rxmcst/s
12:52:22 PM lo 3.00 3.00 2.03 2.03 0.00 0.00 0.00
12:52:22 PM eth4 163496.00 0.00 32599.05 0.00 0.00 0.00 1.00
12:52:22 PM eth7 296820.00 0.00 182314.56 0.00 0.00 0.00 0.00
12:52:22 PM eth5 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth6 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth0 2.00 2.00 0.13 2.54 0.00 0.00 0.00
12:52:22 PM eth1 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth2 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth3 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth0.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth0.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth1.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth1.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth2.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth2.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth3.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth3.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth4.2517 80764.00 0.00 15002.59 0.00 0.00 0.00 0.00
12:52:22 PM eth4.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth5.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth5.2518 12465.00 0.00 2234.42 0.00 0.00 0.00 0.00
12:52:22 PM eth6.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth6.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:22 PM eth7.2517 148826.00 0.00 89501.38 0.00 0.00 0.00 1.00
12:52:22 PM eth7.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00

12:52:22 PM IFACE rxpck/s txpck/s rxkB/s txkB/s rxcmp/s txcmp/s rxmcst/s
12:52:23 PM lo 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth4 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth7 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth5 24659.00 0.00 4853.58 0.00 0.00 0.00 0.00
12:52:23 PM eth6 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth0 2.00 2.00 0.13 2.54 0.00 0.00 0.00
12:52:23 PM eth1 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth2 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth3 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth0.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth0.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth1.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth1.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth2.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth2.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth3.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth3.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth4.2517 81628.00 0.00 15352.01 0.00 0.00 0.00 0.00
12:52:23 PM eth4.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth5.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth5.2518 12765.00 0.00 2335.39 0.00 0.00 0.00 0.00
12:52:23 PM eth6.2517 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth6.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
12:52:23 PM eth7.2517 149436.00 0.00 89991.55 0.00 0.00 0.00 0.00
12:52:23 PM eth7.2518 0.00 0.00 0.00 0.00 0.00 0.00 0.00
^C
probe:~ #
[/HTML]

As you can see the problem appear in the eth4, eth7 and eth5. The problem is that in one time appear data and the other not.

This is the driver of my Netwrok Card:

[HTML]
probe:~ # ethtool -i eth4
driver: ixgbe
version: 3.1.17-NAPI
firmware-version: 0.9-3
bus-info: 0000:11:00.0
probe:~ #

[/HTML]

Any guru that could help me please

2

[QUOTE=andresguillen;11213]As you can see the problem appear in the eth4, eth7 and eth5. The problem is that in one time appear data and the other not.
[/QUOTE]

From the man page:

[QUOTE]Description
The sar command writes to standard output the contents of selected cumulative activity counters in the operating system. The accounting system, based on the values in the count and interval parameters, writes information the specified number of times spaced at the specified intervals in seconds. If the interval parameter is set to zero, the sar command displays the average statistics for the time since the system was started. If the interval parameter is specified without the count parameter, then reports are generated continuously. The collected data can also be saved in the file specified by the -o filename flag, in addition to being displayed onto the screen. If filename is omitted, sar uses the standard system activity daily data file, the /var/log/sa/sadd file, where the dd parameter indicates the current day. By default all the data available from the kernel are saved in the data file. [/QUOTE]

You are seeing the network activity for one second (20, 21, 22, 23). Some intervals show activity, some do not. If you suspect this information is not correct, you can try to monitor the traffic on one of the interfaces using WireShark.