From owner-freebsd-questions@FreeBSD.ORG Thu May 20 12:04:14 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6AAD216A4CE for ; Thu, 20 May 2004 12:04:14 -0700 (PDT) Received: from smtp.infracaninophile.co.uk (happy-idiot-talk.infracaninophile.co.uk [81.2.69.218]) by mx1.FreeBSD.org (Postfix) with ESMTP id ECA2243D49 for ; Thu, 20 May 2004 12:04:12 -0700 (PDT) (envelope-from m.seaman@infracaninophile.co.uk) Received: from happy-idiot-talk.infracaninophile.co.uk (localhost [IPv6:::1]) i4KJ3wuh053833 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 20 May 2004 20:03:58 +0100 (BST) (envelope-from matthew@happy-idiot-talk.infracaninophile.co.uk) Received: (from matthew@localhost)id i4KJ3wLV053832 for freebsd-questions@freebsd.org; Thu, 20 May 2004 20:03:58 +0100 (BST) (envelope-from matthew) Date: Thu, 20 May 2004 20:03:58 +0100 From: Matthew Seaman To: freebsd-questions@freebsd.org Message-ID: <20040520190358.GA10740@happy-idiot-talk.infracaninophile.co.uk> Mail-Followup-To: Matthew Seaman , freebsd-questions@freebsd.org References: <20040520172301.GB3534@gentoo-npk.bmp.ub> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="6TrnltStXW4iwmi0" Content-Disposition: inline In-Reply-To: <20040520172301.GB3534@gentoo-npk.bmp.ub> User-Agent: Mutt/1.5.6i X-Virus-Scanned: clamd / ClamAV version devel-20040504, clamav-milter version 0.70u X-Virus-Status: Clean X-Spam-Status: No, hits=-4.8 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=2.63 X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on happy-idiot-talk.infracaninophile.co.uk Subject: Re: netstat output - diff between 'link' and 'inet' counters X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 May 2004 19:04:14 -0000 --6TrnltStXW4iwmi0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, May 20, 2004 at 11:23:01AM -0600, Nathan Kinkade wrote: > I delved into trying to determine the cause of an unreasonably high > number of Ierrs on a few FreeBSD routers we have setup on campus. While > probing through the netstat output on the machines I realized that I > don't understand the exact difference between the 'inet' and 'link' > protocol families. Now, I understand the difference between IP and > ethernet, but the byte and packet counts for 'inet' and 'link' don't > seem to match what I would expect for those protocols, respectively. > This tells me that the numbers being logged must differ from my > expectations. Generally I notice that the 'inet' counts for an > interface are a relatively small fraction of that for the 'link' > counts for the same interface. However, on our main FreeBSD router that > provides NAT and access to the internet the numbers are somewhat > reversed, with 'inet' counts being much higher than the 'link' counts. > Is there someone who can explain to me exactly what packet and byte > counts actually represent for the 'inet' and 'link' families? I surmise that you're talking about the per-interface statistics as reported by 'netstat -i' or 'netstat -I ifN' rather than any other set of flags to netstat. Let's look at what I get on my system: % netstat -I de0 Name Mtu Network Address Ipkts Ierrs Opkts Oer= rs Coll de0 1500 00:40:05:a5:8d:b7 149504 0 111734 4= 0 de0 1500 81.2.69.216/2 smtp 70771 - 120940 -= - de0 1500 fe80:1::240 fe80:1::240:5ff:f 0 - 3 -= - de0 1500 81.2.69.219/3 arbitrary 371042 - 301860 -= - Now, link#1 corresponds to my local network (from 'netstat -r'): 81.2.69.216/29 link#1 UC 2 0 de0 So the Ipkts count is for all the packets passing that interface with a destination address matching the 81.2.69.216/29 network but not including packets to one of the specific addresses on that interface. That includes many packets for some unused addesses out of my netblock[*] and also packets to the broadcast address 81.2.69.219 The other three entries are for the specific addresses assigned to that interface -- I have the principal IP number on the interface as 81.2.69.218, and a jail using 81.2.69.219, plus the automatically assigned IPv6 link-local address. (IPv6 traffic mostly goes via a gif(4) tunnel which acts like a different interface. Cheers, Matthew [*] It's a feature of the way my network is set up that all such packets will hit the de0 interface of that machine. Normally a network switch will prevent irrelevant traffic from hitting that network interface. --=20 Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way PGP: http://www.infracaninophile.co.uk/pgpkey Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK --6TrnltStXW4iwmi0 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD8DBQFArQEeiD657aJF7eIRAgL0AJ4xEkwbJvz7n4QNsf93p19UELlbxACdG0sT pgnRwEY5nIxOaTtZfVoduTo= =0v0X -----END PGP SIGNATURE----- --6TrnltStXW4iwmi0--