Situation: Server A is receiving network traffic sent from server B to server C. Server B & C send over MySQL dumps. Quite some traffic. For some reason the interface on server A is measuring this traffic. It's not doing anything with it tho, it just sees it.

When I run tcpdump I see that the source and target of the mysql packets are server B and server C. Never server A.

12:52:44.482026 IP $IP_server_B.3306 > $IP_server_A.38662: Flags [.], seq 15905879:15911671, ack 8910, win 62, options [nop,nop,TS val 237711415 ecr 331318504], length 5792

I've double checked the script that send over the dump, the IP of server A is nowhere in that. I've checked if there are IP conflicts - none. The interfaces on all 3 machines have different MAC adresses (just wanted to rule out everything). I can reproduce the behavior on these machines 10 out of 10 times.

All 3 machines are virtual CentOS 6 x64 installations. Server A & B are in the same subnet, server C is in a completely different datacenter and network. Note: Server A & B are in the same subnet, but are not running on the same physical hypervisor.

So.. the question is: how on earth does server A see that traffic?

  • 1
    Have you tried checking the ARP caches on the servers and any intermediate switches? Is there any chance you have stale DNS records?
    – user62491
    Feb 18, 2013 at 5:03
  • Was this a cleanup mistake or is it actually sending them to IP_server_A? $IP_server_B.3306 > $IP_server_A.38662
    – GnP
    Jul 10, 2013 at 20:06

1 Answer 1


If the Server A and B are connected to a simple Hub instead of a smarter Switch, all traffic will be broadcasted to all connected machines. Then its up to the machines to decide if this traffic they receive is for them or if they should just ignore it. Tcpdump, by default, puts your interface into promiscous mode, which means it doesnt ignore any traffic, not even the one which isn't addressed to it. That's why with Tcpdump you can see all the traffic on your hub.

  • No hub tho, expensive managed switching equipment... Feb 16, 2013 at 14:25
  • Then I don't know... possibly just the configuration of the switch then.
    – replay
    Feb 16, 2013 at 14:27
  • Thought about that too. But since these are virtual boxes and no other virtual box on the netwerk (even on the same physical machine) doesn't see the same network traffic, I think I could rule out the switch. Feb 16, 2013 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.