> In  this  case,  would  they  be  packets  TO  or FROM the ppp device?
FROM, of course. When a packet reaches IP, the device is already destroyed.
This is impossible, unless driver is broken or we have an error
in reference counting. The second possibility is eliminated by the fact,
that you do not see "Freeing alive device". So, device was cleanly
unregistered.
> No such message in logs, but  "PPPIOCDETACH  file->f_count=3"
I will look. It sounds as an interesting hint.
> - pptp  (PoPToP). But pptp is only userland software, how could it cause
> such a problem?
In no way.
> thus re-injected to the stack later than  usual?  (I'm  probably  just
> talking nonsense here - sorry - trying to guess).
It is not a nonsense. However, iptables hold necessary reference counts.
> - assymetrical routing:
This is not essential.
> -a shows "duplicate" ppp devices e.g.:
....
> Is this "normal"?
Well, ifconfig can be racy. If some device sitting in the list before ppp96
was deleted while ifconfig scanned the list, you can see ppp96 twice.
If some device was added, ifconfig can lose some device. Awkward, of course.
Alexey
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/