OT: strange mac-accounting statistics on a router's public

From: Alexei Monastyrnyi (alexeim@orcsoftware.com)
Date: Thu Jan 03 2008 - 07:16:25 ARST


Dear GS members,
some real-life question.

On a router connected to the Internet with just one customer allowed on
the outside interface with help of ACL, I have some strange
mac-accounting statistics:

FastEthernet0/1 ---> Internet
  Input (0 free)
    0000.fe2f.74a5(0 ): 39591 packets, 10112810 bytes, last: 36932ms ago
    0000.fe2f.78a9(0 ): 39121 packets, 9991201 bytes, last: 6476ms ago
    0000.fe2f.72a2(1 ): 39695 packets, 10126983 bytes, last: 29140ms ago
    0000.fe2f.78ab(2 ): 39363 packets, 10042647 bytes, last: 2608ms ago
[...]
    0000.fe2f.745b(254): 39774 packets, 10154962 bytes, last: 4076ms ago
    0000.fe2f.745a(255): 39983 packets, 10205331 bytes, last: 4112ms ago
    0000.fe2f.7759(255): 39441 packets, 10071600 bytes, last: 4180ms ago
    0000.fe2f.7856(255): 39520 packets, 10083740 bytes, last: 19396ms ago
                  Total: 22817209 packets, 5990M bytes

As you can see, MAC addresses are in order under 0000.fe2f, those MAC
addresses are never seen in ARP table.

There is a customer VPN terminated on the router with GRE tunnel inside
for multicast traffic.

Router is
Cisco IOS Software, 2800 Software (C2800NM-ADVSECURITYK9-M), Version
12.4(15)T1, RELEASE SOFTWARE (fc2)
Cisco 2811 (revision 53.51) with 249856K/12288K bytes of memory.
Processor board ID FCZ100170EY
6 FastEthernet interfaces
2 Virtual Private Network (VPN) Modules
DRAM configuration is 64 bits wide with parity enabled.
239K bytes of non-volatile configuration memory.
62720K bytes of ATA CompactFlash (Read/Write)

I would appreciate one for a shedding some light on this.

A.



This archive was generated by hypermail 2.1.4 : Fri Feb 01 2008 - 10:37:57 ARST