From owner-freebsd-questions@FreeBSD.ORG Thu Dec 6 09:05:48 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 72340D05 for ; Thu, 6 Dec 2012 09:05:48 +0000 (UTC) (envelope-from matthew@freebsd.org) Received: from smtp.infracaninophile.co.uk (smtp6.infracaninophile.co.uk [IPv6:2001:8b0:151:1:3cd3:cd67:fafa:3d78]) by mx1.freebsd.org (Postfix) with ESMTP id F31768FC15 for ; Thu, 6 Dec 2012 09:05:47 +0000 (UTC) Received: from rufus.webfusion.com (mail.heartinternet.co.uk [79.170.40.31]) (authenticated bits=0) by smtp.infracaninophile.co.uk (8.14.5/8.14.5) with ESMTP id qB695Wp7091707 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO); Thu, 6 Dec 2012 09:05:38 GMT (envelope-from matthew@freebsd.org) DKIM-Filter: OpenDKIM Filter v2.7.1 smtp.infracaninophile.co.uk qB695Wp7091707 Authentication-Results: smtp.infracaninophile.co.uk/qB695Wp7091707; dkim=none reason="no signature"; dkim-adsp=none (insecure policy) X-Authentication-Warning: lucid-nonsense.infracaninophile.co.uk: Host mail.heartinternet.co.uk [79.170.40.31] claimed to be rufus.webfusion.com Message-ID: <50C05FD8.1040609@freebsd.org> Date: Thu, 06 Dec 2012 09:05:28 +0000 From: Matthew Seaman User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Olivier Nicole Subject: Re: netstat -i References: <201212060551.qB65phdO016130@banyan.cs.ait.ac.th> In-Reply-To: <201212060551.qB65phdO016130@banyan.cs.ait.ac.th> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: clamav-milter 0.97.6 at lucid-nonsense.infracaninophile.co.uk X-Virus-Status: Clean X-Spam-Status: No, score=-1.5 required=5.0 tests=AWL,BAYES_00,SPF_SOFTFAIL autolearn=no version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on lucid-nonsense.infracaninophile.co.uk Cc: freebsd-questions@freebsd.org X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Dec 2012 09:05:48 -0000 On 06/12/2012 05:51, Olivier Nicole wrote: > I used netstat -i for the first time and I saw something I cannot > understand: > > # netstat -ibh -I em1 > Name Mtu Network Address Ipkts Opkts > em1 9000 00:0e:0c:5c:32:29 92M 129M > em1 9000 10.41.170/24 ufo2000 924K 926K > > I understand that the line reporting MAc address means the traffic > seen at layer2, while the line reporting IP address means the traffic > seen at layer3. > > How would that be possible to have suh a difference (on a switched > network)? It's certainly possible -- arp (and dhcp to some extent) involve sending broadcast packets at layer 2. There can be a lot of arp traffic on a well-populated network, or if you're going things like running multiple layer 3 networks over the same physical infrastructure. There can be other forms of Ethernet-only (rather than IP traffic) -- switches often speak to each other like that. Generally it is not a problem unless it is affecting performance, at which point the answer is to segment the network into smaller broadcast domains by sub-netting and/or using VLANs. Cheers, Matthew