Date: Mon, 04 Jun 2007 08:16:05 -0500 From: Reid Linnemann <lreid@cs.okstate.edu> To: Tom Worster <fsb@thefsb.org> Cc: freebsd-questions@freebsd.org Subject: Re: netstat -i output Message-ID: <46641095.2090401@cs.okstate.edu> In-Reply-To: <47012.192.168.1.35.1180778422.webmail@192.168.1.35> References: <47012.192.168.1.35.1180778422.webmail@192.168.1.35>
next in thread | previous in thread | raw e-mail | index | archive | help
Written by Tom Worster on 06/02/07 05:00>> > i'm confused by the output from netstat -i: > > Name Mtu Network Address Ipkts Ierrs Ibytes Opkts Oerrs Obytes Coll > bge0 1500 <Link#1> 00:30:48:5e:56:8a 7.4M 1.2K 4.9G 2.9M 0 2.6G 0 > bge0 1500 65.39.221/24 www1 2.9M - 414M 3.0M - 2.5G - > > it lists the same interface twice. what is the difference between these two? > > this is a web server so wny so much more input bytes than output? > > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org" The first is the ethernet address family, the other is ipv4. If you notice, your ipv4 statistics show 414Mb in ang 2.5 Gb out, with roughly a 1:1 ratio of input and output packets. This would seem logical, since http is a request:response protocol. Remember that IP is a network layer protocol, which is mainly facilitated by the ethernet data link layer protocol, but ethernet is not simply relegated to servicing IP communications, many other services and protocols use ethernet. For instance, many blade/rack systems these days use some sort of network console over ethernet, which I would assume generates far less input bytes than output bytes on the machines. This is just one example, there's far more things that use ethernet than I can be aware of.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?46641095.2090401>