From owner-freebsd-stable@FreeBSD.ORG  Sun Feb 20 18:22:06 2005
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 4655616A4CE
	for <freebsd-stable@freebsd.org>;
	Sun, 20 Feb 2005 18:22:06 +0000 (GMT)
Received: from mail.distalzou.net (203.141.139.231.user.ad.il24.net
	[203.141.139.231])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 71D4443D45
	for <freebsd-stable@freebsd.org>;
	Sun, 20 Feb 2005 18:22:05 +0000 (GMT)
	(envelope-from devin@spamcop.net)
Received: from plexi.pun-pun.prv ([192.168.7.29] helo=plexi)
	by mail.distalzou.net with esmtps (TLSv1:AES256-SHA:256)
	(Exim 4.44 (FreeBSD))
	id 1D2viW-000Je4-0R
	for freebsd-stable@freebsd.org; Mon, 21 Feb 2005 03:22:04 +0900
Date: Mon, 21 Feb 2005 03:22:03 +0900 (JST)
From: Tod McQuillin <devin@spamcop.net>
X-X-Sender: devin@plexi.pun-pun.prv
To: freebsd-stable@freebsd.org
Message-ID: <20050221031739.G684@plexi.pun-pun.prv>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Subject: Help me understand netstat output
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Production branch of FreeBSD source code
	<freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 20 Feb 2005 18:22:06 -0000


On a 5.3-STABLE system (and actually for the past few years on FreeBSD 4.x 
and 5.x), 'netstat -in' has show numbers like this:

Name    Mtu Network       Address              Ipkts Ierrs    Opkts Oerrs  Coll
xl0    1500 <Link#1>      00:04:76:5f:45:1f   622543     0   621123     0     0
xl0    1500 192.168.7     192.168.7.28        622208     -  2110040     -     -
lo0   16384 <Link#3>                             169     0      169     0     0
lo0   16384 127           127.0.0.1              169     -      169     -     -
wi0*   1500 <Link#4>      00:02:2d:29:28:7f        0     0        0     0     0

Why does the second line for xl0 show so many more outgoing packets than 
the first line?

It seems to me the first line (Link#1) should count all packets at OSI 
layer 2, and the second should count layer 3 (IP) packets.  I can see the 
layer 2 count being bigger than layer 3 count (lots of arp or other 
ether-only traffic) but not the other way around.

Anyone know the explanation for this?
-- 
Tod McQuillin