From owner-freebsd-net@freebsd.org Sun Jun 23 10:56:57 2019 Return-Path: Delivered-To: freebsd-net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 4AD4415CD20F for ; Sun, 23 Jun 2019 10:56:57 +0000 (UTC) (envelope-from marco@tols.org) Received: from tolstoy.tols.org (tolstoy-a1.tols.org [IPv6:2a02:898:57:3::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 9DA6D85A2F for ; Sun, 23 Jun 2019 10:56:54 +0000 (UTC) (envelope-from marco@tols.org) Received: from 82-217-131-200.cable.dynamic.v4.ziggo.nl ([82.217.131.200] helo=[192.168.178.123]) by tolstoy.tols.org with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92 (FreeBSD)) (envelope-from ) id 1hf0B1-000Ir0-8J; Sun, 23 Jun 2019 12:56:51 +0200 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Subject: Re: net.inet.ip.stats - struct ipstat.ips_total - appears to be double the actual number From: Marco van Tol In-Reply-To: <7861F570-6FD2-4BD0-B33B-D7F90BE44B77@tols.org> Date: Sun, 23 Jun 2019 12:56:45 +0200 Cc: Marco van Tol Content-Transfer-Encoding: quoted-printable Message-Id: <1BA006DD-2883-4960-948F-2674E5983AA7@tols.org> References: <7861F570-6FD2-4BD0-B33B-D7F90BE44B77@tols.org> To: freebsd-net@freebsd.org X-Mailer: Apple Mail (2.3445.104.11) X-Tolsorg-Spam-Score: -1.0 (-) X-Rspamd-Queue-Id: 9DA6D85A2F X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; spf=pass (mx1.freebsd.org: domain of marco@tols.org designates 2a02:898:57:3::1 as permitted sender) smtp.mailfrom=marco@tols.org X-Spamd-Result: default: False [-4.52 / 15.00]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; RCVD_COUNT_TWO(0.00)[2]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+a:tolstoy-a1.tols.org]; MV_CASE(0.50)[]; MIME_GOOD(-0.10)[text/plain]; DMARC_NA(0.00)[tols.org]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; TO_MATCH_ENVRCPT_SOME(0.00)[]; MX_GOOD(-0.01)[mickey.tols.org]; RCPT_COUNT_TWO(0.00)[2]; NEURAL_HAM_SHORT(-0.99)[-0.991,0]; IP_SCORE(-1.72)[ipnet: 2a02:898::/32(-4.81), asn: 8283(-3.82), country: NL(0.01)]; RECEIVED_SPAMHAUS_PBL(0.00)[200.131.217.82.zen.spamhaus.org : 127.0.0.11]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:8283, ipnet:2a02:898::/32, country:NL]; MID_RHS_MATCH_FROM(0.00)[]; RCVD_TLS_ALL(0.00)[]; FROM_EQ_ENVFROM(0.00)[] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Jun 2019 10:56:57 -0000 Op 20 jun. 2019, om 22:32 heeft Marco van Tol het = volgende geschreven: >=20 > Hi there, >=20 > I'm trying to write a patch for collectd to generate trend graphs on = ipv4 and ipv6 statistics. >=20 > I use the sysctls net.inet.ip.stats and net.inet6.ip6.stats for this. >=20 > The structs I use to parse these sysctls are "struct ipstat" and = "struct ip6stat". >=20 > While doing this, I keep running into the fact that the "struct = ipstat.ips_total" count seems to be twice the number of ipv4 packets = that actually got received on a host. Does this make any sense at all? >=20 > So, in other words, if I call "sysctls net.inet.ip.stats", and do = another call 1 second later, I can deduce a per-second incoming ipv4 = packet rate. This seems to be twice as high as actually happening. >=20 > The number reported in struct ip6stat.ip6s_total seems to be correct. >=20 > Is there any reason for the ips_total to be twice the number of ipv4 = packets that actually got received? >=20 > Another way to witness these counts is by doing: netstat -s -p ip, and = then checkout "total packets received" on a per-second basis. To briefly come back to this, when I count the components in the output = for "netstat -s -p ip" it adds up to roughly half of total packets = received, like in the following example: -----< sum for the below proto ip >----- 62,770,301 total packets received 1,451,001 + 25,691,568 + 3,719,636 =3D 30,862,205 =3D> Approximately half the total packets received. -----< cut here >----- # netstat -s -p ip ip: 62770301 total packets received 0 bad header checksums 0 with size smaller than minimum 0 with data size < data length 0 with ip length > max ip packet size 0 with header length < data size 0 with data length < header length 0 with bad options 0 with incorrect version number 0 fragments received 0 fragments dropped (dup or out of space) 0 fragments dropped after timeout 0 packets reassembled ok 1451001 packets for this host 0 packets for unknown/unsupported protocol 25691568 packets forwarded (25683102 packets fast forwarded) 3719636 packets not forwardable 0 packets received for unknown multicast group 0 redirects sent -----< cut here >----- While on the same host for IPv6: -----< sum for the below proto ip >----- 5,848,829 total packets received 1,177,571 + 2,489,660 + 1,482,403 =3D 5,149,634 =3D> Much closer to total packets received -----< cut here >----- # netstat -s -p ip6 ip6: 5848829 total packets received 0 with size smaller than minimum 0 with data size < data length 0 with bad options 0 with incorrect version number 0 fragments received 0 fragments dropped (dup or out of space) 0 fragments dropped after timeout 0 fragments that exceeded limit 0 packets reassembled ok 1177571 packets for this host 2489660 packets forwarded 1482403 packets not forwardable 0 redirects sent -----< cut here >----- What am I overlooking? :-) --=20 Marco van Tol