From owner-freebsd-questions@FreeBSD.ORG Thu Dec 6 09:30:21 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id CB4BCA61 for ; Thu, 6 Dec 2012 09:30:21 +0000 (UTC) (envelope-from matthew@freebsd.org) Received: from smtp.infracaninophile.co.uk (smtp6.infracaninophile.co.uk [IPv6:2001:8b0:151:1:3cd3:cd67:fafa:3d78]) by mx1.freebsd.org (Postfix) with ESMTP id 3EEF58FC0C for ; Thu, 6 Dec 2012 09:30:21 +0000 (UTC) Received: from rufus.webfusion.com (mail.heartinternet.co.uk [79.170.40.31]) (authenticated bits=0) by smtp.infracaninophile.co.uk (8.14.5/8.14.5) with ESMTP id qB69UEYo092244 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO); Thu, 6 Dec 2012 09:30:14 GMT (envelope-from matthew@freebsd.org) DKIM-Filter: OpenDKIM Filter v2.7.1 smtp.infracaninophile.co.uk qB69UEYo092244 Authentication-Results: smtp.infracaninophile.co.uk/qB69UEYo092244; dkim=none reason="no signature"; dkim-adsp=none (insecure policy) X-Authentication-Warning: lucid-nonsense.infracaninophile.co.uk: Host mail.heartinternet.co.uk [79.170.40.31] claimed to be rufus.webfusion.com Message-ID: <50C065A6.6080704@freebsd.org> Date: Thu, 06 Dec 2012 09:30:14 +0000 From: Matthew Seaman User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Olivier Nicole Subject: Re: netstat -i References: <201212060551.qB65phdO016130@banyan.cs.ait.ac.th> <50C05FD8.1040609@freebsd.org> <201212060912.qB69CcTG018111@banyan.cs.ait.ac.th> In-Reply-To: <201212060912.qB69CcTG018111@banyan.cs.ait.ac.th> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: clamav-milter 0.97.6 at lucid-nonsense.infracaninophile.co.uk X-Virus-Status: Clean X-Spam-Status: No, score=-1.5 required=5.0 tests=AWL,BAYES_00,SPF_SOFTFAIL autolearn=no version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on lucid-nonsense.infracaninophile.co.uk Cc: freebsd-questions@freebsd.org X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Dec 2012 09:30:21 -0000 On 06/12/2012 09:12, Olivier Nicole wrote: > There is only one layer 3 network on that physical infrastructure (at > least in that VLAN). And there are only 8 machines in that VLAN, no > routing, as the VLAN is primarily designed for NFS. > > I did not sjow the most disturbing figure where at output bytes is 3.7 > TB at MAC level but only 156 GB at IP level (2000 times less). The > large amount of output bytes is understandable for the machine is an > NFS server. > > 3TB is not big, but is at IP level, not at MAC level. It could be down to broken equipment attached to the network. If something is spewing out malformed packets, you might well see that sort of effect. Try firing up tcpdump or wireshark -- they'll both capture the layer 2 traffic and given the volumes you're seeing, it should be fairly obvious from visual inspection of the output what is going on. Cheers, Matthew