From owner-freebsd-questions@FreeBSD.ORG Thu May 20 13:28:08 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3E7F616A4CE for ; Thu, 20 May 2004 13:28:08 -0700 (PDT) Received: from out2.smtp.messagingengine.com (out2.smtp.messagingengine.com [66.111.4.26]) by mx1.FreeBSD.org (Postfix) with ESMTP id B8AF743D53 for ; Thu, 20 May 2004 13:28:06 -0700 (PDT) (envelope-from nkinkade@fastmail.fm) X-Sasl-enc: ISNumZKBsIqcm8fb16XSyA 1085084880 Received: from gentoo-npk.bmp.ub (unknown [206.27.244.136]) by www.fastmail.fm (Postfix) with ESMTP id C1058BAF267 for ; Thu, 20 May 2004 16:28:00 -0400 (EDT) Received: from nkinkade by gentoo-npk.bmp.ub with local (Exim 4.21) id 1BQu8z-0002Cn-FK for freebsd-questions@freebsd.org; Thu, 20 May 2004 14:27:57 -0600 Date: Thu, 20 May 2004 14:27:57 -0600 From: Nathan Kinkade To: freebsd-questions@freebsd.org Message-ID: <20040520202757.GF3534@gentoo-npk.bmp.ub> Mail-Followup-To: freebsd-questions@freebsd.org References: <20040520172301.GB3534@gentoo-npk.bmp.ub> <20040520190358.GA10740@happy-idiot-talk.infracaninophile.co.uk> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="2CKPe999o93Mtx0C" Content-Disposition: inline In-Reply-To: <20040520190358.GA10740@happy-idiot-talk.infracaninophile.co.uk> User-Agent: Mutt/1.5.6i Sender: Subject: Re: netstat output - diff between 'link' and 'inet' counters X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Nathan Kinkade List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 May 2004 20:28:08 -0000 --2CKPe999o93Mtx0C Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, May 20, 2004 at 08:03:58PM +0100, Matthew Seaman wrote: > On Thu, May 20, 2004 at 11:23:01AM -0600, Nathan Kinkade wrote: > > I delved into trying to determine the cause of an unreasonably high > > number of Ierrs on a few FreeBSD routers we have setup on campus. While > > probing through the netstat output on the machines I realized that I > > don't understand the exact difference between the 'inet' and 'link' > > protocol families. Now, I understand the difference between IP and > > ethernet, but the byte and packet counts for 'inet' and 'link' don't > > seem to match what I would expect for those protocols, respectively. > > This tells me that the numbers being logged must differ from my > > expectations. Generally I notice that the 'inet' counts for an > > interface are a relatively small fraction of that for the 'link' > > counts for the same interface. However, on our main FreeBSD router that > > provides NAT and access to the internet the numbers are somewhat > > reversed, with 'inet' counts being much higher than the 'link' counts. > > Is there someone who can explain to me exactly what packet and byte > > counts actually represent for the 'inet' and 'link' families? >=20 > I surmise that you're talking about the per-interface statistics as > reported by 'netstat -i' or 'netstat -I ifN' rather than any other set > of flags to netstat. Let's look at what I get on my system: >=20 > % netstat -I de0 > Name Mtu Network Address Ipkts Ierrs Opkts O= errs Coll > de0 1500 00:40:05:a5:8d:b7 149504 0 111734 = 4 0 > de0 1500 81.2.69.216/2 smtp 70771 - 120940 = - - > de0 1500 fe80:1::240 fe80:1::240:5ff:f 0 - 3 = - - > de0 1500 81.2.69.219/3 arbitrary 371042 - 301860 = - - >=20 > Now, link#1 corresponds to my local network (from 'netstat -r'): >=20 > 81.2.69.216/29 link#1 UC 2 0 de0 >=20 > So the Ipkts count is for all the packets passing that interface with > a destination address matching the 81.2.69.216/29 network but not > including packets to one of the specific addresses on that > interface. That includes many packets for some unused addesses out of > my netblock[*] and also packets to the broadcast address 81.2.69.219 >=20 > The other three entries are for the specific addresses assigned to > that interface -- I have the principal IP number on the interface as > 81.2.69.218, and a jail using 81.2.69.219, plus the automatically > assigned IPv6 link-local address. (IPv6 traffic mostly goes via a > gif(4) tunnel which acts like a different interface. >=20 > Cheers, >=20 > Matthew Yes, I was referring to netstat's output with the '-i' switch. The information you provided is exactly what I was looking for. Thanks! Nathan --2CKPe999o93Mtx0C Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFArRTNO0ZIEthSfkkRAvMmAKC2Z3Eln6upIM9if/85IbVVb5slLACg7Ut+ cqS8RdWzJ6PM0Y/RS/tTCQg= =I1or -----END PGP SIGNATURE----- --2CKPe999o93Mtx0C--