From owner-freebsd-questions@FreeBSD.ORG Fri Dec 7 03:04:23 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id C217E93F; Fri, 7 Dec 2012 03:04:23 +0000 (UTC) (envelope-from olivier2553@gmail.com) Received: from mail-pa0-f54.google.com (mail-pa0-f54.google.com [209.85.220.54]) by mx1.freebsd.org (Postfix) with ESMTP id 896498FC17; Fri, 7 Dec 2012 03:04:23 +0000 (UTC) Received: by mail-pa0-f54.google.com with SMTP id bi5so128056pad.13 for ; Thu, 06 Dec 2012 19:04:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=EcCCMZ5CWWoOyt20iWggAEXgXH7ERauGAXCy0udqGEo=; b=OV8BqJyUU1E8ZqfFi0Hi7tmV7MgEzWkNsY6efTsi3A7AMUemswae/UvVb9+rieCI/v eDeB49lNP/ixsc6uCR7T8ppa37S3WXLPXPzKOsQfL4AmS2t+r4G8Y7n/Jao80bm3McNd +1QEwG/V+vp+m8Yxg27O0xwjcgF+sdn5+m8VCd9oDw6hrCX/5p7LelZmsuOwd2u4++wj nMAD24ia+hJYATD0fVoXURwyIgH9vlu1+Q6elIqhjMmXvuGRNnD4XQnGfbvGTlOTN9yn 7Fcq6YHBe/KdOKiBGnbu5g4JWdMa7KbhRKZ3hgdxbVdyoezlEgGXwtuJ3l7vFTYXZrW1 Ek6A== MIME-Version: 1.0 Received: by 10.68.234.229 with SMTP id uh5mr11237542pbc.123.1354849462061; Thu, 06 Dec 2012 19:04:22 -0800 (PST) Sender: olivier2553@gmail.com Received: by 10.68.22.41 with HTTP; Thu, 6 Dec 2012 19:04:21 -0800 (PST) In-Reply-To: <50C065A6.6080704@freebsd.org> References: <201212060551.qB65phdO016130@banyan.cs.ait.ac.th> <50C05FD8.1040609@freebsd.org> <201212060912.qB69CcTG018111@banyan.cs.ait.ac.th> <50C065A6.6080704@freebsd.org> Date: Fri, 7 Dec 2012 10:04:21 +0700 X-Google-Sender-Auth: e2DO3CYmt8x4K_blH8fqV-pW4NA Message-ID: Subject: Re: netstat -i From: Olivier Nicole To: Matthew Seaman Content-Type: text/plain; charset=ISO-8859-1 Cc: freebsd-questions@freebsd.org X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 03:04:23 -0000 Thank you Matthew and Ilya, >> There is only one layer 3 network on that physical infrastructure (at >> least in that VLAN). And there are only 8 machines in that VLAN, no >> routing, as the VLAN is primarily designed for NFS. >> >> I did not sjow the most disturbing figure where at output bytes is 3.7 >> TB at MAC level but only 156 GB at IP level (2000 times less). The >> large amount of output bytes is understandable for the machine is an >> NFS server. >> >> 3TB is not big, but is at IP level, not at MAC level. > > It could be down to broken equipment attached to the network. If > something is spewing out malformed packets, you might well see that sort > of effect. > > Try firing up tcpdump or wireshark -- they'll both capture the layer 2 > traffic and given the volumes you're seeing, it should be fairly obvious > from visual inspection of the output what is going on. I tried wireshark with 2 filters: filter "not ip" shows only spanning tree packets, almost no traffic filter "ip" shows the bulk of traffic filter "ip and not host 10.41.170.1" shows no traffic That was expected. So I believe it has something to do with the way netstat -i reports the data. Best regards, Olivier