From owner-freebsd-questions@FreeBSD.ORG Thu Dec 6 09:12:39 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id BD5168F; Thu, 6 Dec 2012 09:12:39 +0000 (UTC) (envelope-from Olivier.Nicole@cs.ait.ac.th) Received: from mail.cs.ait.ac.th (mail.cs.ait.ac.th [192.41.170.16]) by mx1.freebsd.org (Postfix) with ESMTP id 531788FC0C; Thu, 6 Dec 2012 09:12:38 +0000 (UTC) Received: from mail.cs.ait.ac.th (localhost [127.0.0.1]) by mail.cs.ait.ac.th (Postfix) with ESMTP id B92953A387C; Thu, 6 Dec 2012 16:12:37 +0700 (ICT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.ait.ac.th; h= references:subject:subject:in-reply-to:from:from:message-id:date :date:received:received:received; s=selector1; t=1354785157; x= 1356599558; bh=u3CAalr5epAOHKNnIuUiykBDr554a20IJQKttoTFv1s=; b=U vbriu8M6CcSyLaYSip+cDGjhdXt6X01fiKyi7bVu78rc9FSRu/qks/BGSn0QNxAe /h98oMy0TDaN85zbtvU1morAl/bhkhMgYC/fJqXfUHSAKAYAhBg4CGCf4cUv2ns9 c0D4jBAPkQ3kAspkLLLC+d7mxlboseF4tO5Ks0NnOk= X-Virus-Scanned: amavisd-new at cs.ait.ac.th Received: from mail.cs.ait.ac.th ([127.0.0.1]) by mail.cs.ait.ac.th (mail.cs.ait.ac.th [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id eIj01DJ6Q-0g; Thu, 6 Dec 2012 16:12:37 +0700 (ICT) Received: from banyan.cs.ait.ac.th (banyan.cs.ait.ac.th [192.41.170.5]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.cs.ait.ac.th (Postfix) with ESMTPS id 6B9AD3A384A; Thu, 6 Dec 2012 16:12:37 +0700 (ICT) Received: (from on@localhost) by banyan.cs.ait.ac.th (8.14.5/8.14.5/Submit) id qB69CcTG018111; Thu, 6 Dec 2012 16:12:38 +0700 (ICT) (envelope-from on) Date: Thu, 6 Dec 2012 16:12:38 +0700 (ICT) Message-Id: <201212060912.qB69CcTG018111@banyan.cs.ait.ac.th> From: Olivier Nicole To: matthew@freebsd.org In-reply-to: <50C05FD8.1040609@freebsd.org> (message from Matthew Seaman on Thu, 06 Dec 2012 09:05:28 +0000) Subject: Re: netstat -i References: <201212060551.qB65phdO016130@banyan.cs.ait.ac.th> <50C05FD8.1040609@freebsd.org> Cc: freebsd-questions@freebsd.org X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Dec 2012 09:12:40 -0000 Matthew, > > Name Mtu Network Address Ipkts Opkts > > em1 9000 00:0e:0c:5c:32:29 92M 129M > > em1 9000 10.41.170/24 ufo2000 924K 926K > > > > I understand that the line reporting MAc address means the traffic > > seen at layer2, while the line reporting IP address means the traffic > > seen at layer3. > > > > How would that be possible to have suh a difference (on a switched > > network)? > > It's certainly possible -- arp (and dhcp to some extent) involve sending > broadcast packets at layer 2. There can be a lot of arp traffic on a > well-populated network, or if you're going things like running multiple > layer 3 networks over the same physical infrastructure. There can be > other forms of Ethernet-only (rather than IP traffic) -- switches often > speak to each other like that. Generally it is not a problem unless it > is affecting performance, at which point the answer is to segment the > network into smaller broadcast domains by sub-netting and/or using VLANs. There is only one layer 3 network on that physical infrastructure (at least in that VLAN). And there are only 8 machines in that VLAN, no routing, as the VLAN is primarily designed for NFS. I did not sjow the most disturbing figure where at output bytes is 3.7 TB at MAC level but only 156 GB at IP level (2000 times less). The large amount of output bytes is understandable for the machine is an NFS server. 3TB is not big, but is at IP level, not at MAC level. Best regards, Olivier