From owner-freebsd-questions@FreeBSD.ORG Tue Feb 21 10:10:55 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4CFD216A430 for ; Tue, 21 Feb 2006 10:10:55 +0000 (GMT) (envelope-from robin@reportlab.com) Received: from relay00.pair.com (relay00.pair.com [209.68.5.9]) by mx1.FreeBSD.org (Postfix) with SMTP id C537D43D48 for ; Tue, 21 Feb 2006 10:10:54 +0000 (GMT) (envelope-from robin@reportlab.com) Received: (qmail 61665 invoked from network); 21 Feb 2006 10:10:53 -0000 Received: from unknown (HELO ?192.168.0.3?) (unknown) by unknown with SMTP; 21 Feb 2006 10:10:53 -0000 X-pair-Authenticated: 217.196.247.135 Message-ID: <43FAE72D.4000208@chamonix.reportlab.co.uk> Date: Tue, 21 Feb 2006 10:10:53 +0000 From: Robin Becker User-Agent: Thunderbird 1.5 (Windows/20051201) MIME-Version: 1.0 To: freebsd-questions@freebsd.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: traffic analysis X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Feb 2006 10:10:55 -0000 Our freeBSD 6.0 host is not yet in production, but appears to have outgoing traffic of around 140Mb/day; the http logs say 16 hits etc. The host provider said this "The server is on a /20-network, and this leads to high amounts of background traffic (ARP, broadcast, etc.). These traffic types are likely to be the reason for most of your outbound traffic." I'm not sure I follow this argument. Does this mean I'm responding to large number of spurious requests? The provider's analysis of the input volume is pretty small (0Mb). Is there a tool that can give me some reasonable data on this sort of problem? Perhaps I need to close down some services etc. -- Robin Becker