From owner-freebsd-questions@FreeBSD.ORG Mon Jun 4 13:16:11 2007 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 7B28516A400 for ; Mon, 4 Jun 2007 13:16:11 +0000 (UTC) (envelope-from lreid@cs.okstate.edu) Received: from a.cs.okstate.edu (a.cs.okstate.edu [139.78.113.1]) by mx1.freebsd.org (Postfix) with ESMTP id 5E7F813C458 for ; Mon, 4 Jun 2007 13:16:11 +0000 (UTC) (envelope-from lreid@cs.okstate.edu) Received: from [172.18.0.137] (sky_cpfw-1.tulsatech.org [70.168.226.130]) by a.cs.okstate.edu (Postfix) with ESMTP id 72F1AA0635; Mon, 4 Jun 2007 08:16:10 -0500 (CDT) Message-ID: <46641095.2090401@cs.okstate.edu> Date: Mon, 04 Jun 2007 08:16:05 -0500 From: Reid Linnemann User-Agent: Thunderbird 2.0.0.0 (X11/20070517) MIME-Version: 1.0 To: Tom Worster References: <47012.192.168.1.35.1180778422.webmail@192.168.1.35> In-Reply-To: <47012.192.168.1.35.1180778422.webmail@192.168.1.35> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-questions@freebsd.org Subject: Re: netstat -i output X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Jun 2007 13:16:11 -0000 Written by Tom Worster on 06/02/07 05:00>> > i'm confused by the output from netstat -i: > > Name Mtu Network Address Ipkts Ierrs Ibytes Opkts Oerrs Obytes Coll > bge0 1500 00:30:48:5e:56:8a 7.4M 1.2K 4.9G 2.9M 0 2.6G 0 > bge0 1500 65.39.221/24 www1 2.9M - 414M 3.0M - 2.5G - > > it lists the same interface twice. what is the difference between these two? > > this is a web server so wny so much more input bytes than output? > > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org" The first is the ethernet address family, the other is ipv4. If you notice, your ipv4 statistics show 414Mb in ang 2.5 Gb out, with roughly a 1:1 ratio of input and output packets. This would seem logical, since http is a request:response protocol. Remember that IP is a network layer protocol, which is mainly facilitated by the ethernet data link layer protocol, but ethernet is not simply relegated to servicing IP communications, many other services and protocols use ethernet. For instance, many blade/rack systems these days use some sort of network console over ethernet, which I would assume generates far less input bytes than output bytes on the machines. This is just one example, there's far more things that use ethernet than I can be aware of.