Date: Thu, 06 Dec 2012 09:05:28 +0000 From: Matthew Seaman <matthew@freebsd.org> To: Olivier Nicole <Olivier.Nicole@cs.ait.ac.th> Cc: freebsd-questions@freebsd.org Subject: Re: netstat -i Message-ID: <50C05FD8.1040609@freebsd.org> In-Reply-To: <201212060551.qB65phdO016130@banyan.cs.ait.ac.th> References: <201212060551.qB65phdO016130@banyan.cs.ait.ac.th>
next in thread | previous in thread | raw e-mail | index | archive | help
On 06/12/2012 05:51, Olivier Nicole wrote: > I used netstat -i for the first time and I saw something I cannot > understand: > > # netstat -ibh -I em1 > Name Mtu Network Address Ipkts Opkts > em1 9000 <Link#2> 00:0e:0c:5c:32:29 92M 129M > em1 9000 10.41.170/24 ufo2000 924K 926K > > I understand that the line reporting MAc address means the traffic > seen at layer2, while the line reporting IP address means the traffic > seen at layer3. > > How would that be possible to have suh a difference (on a switched > network)? It's certainly possible -- arp (and dhcp to some extent) involve sending broadcast packets at layer 2. There can be a lot of arp traffic on a well-populated network, or if you're going things like running multiple layer 3 networks over the same physical infrastructure. There can be other forms of Ethernet-only (rather than IP traffic) -- switches often speak to each other like that. Generally it is not a problem unless it is affecting performance, at which point the answer is to segment the network into smaller broadcast domains by sub-netting and/or using VLANs. Cheers, Matthew
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?50C05FD8.1040609>