From owner-freebsd-questions@FreeBSD.ORG Tue Feb 21 16:14:53 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B4D7E16A420 for ; Tue, 21 Feb 2006 16:14:53 +0000 (GMT) (envelope-from robin@reportlab.com) Received: from relay02.pair.com (relay02.pair.com [209.68.5.16]) by mx1.FreeBSD.org (Postfix) with SMTP id 4210A43D45 for ; Tue, 21 Feb 2006 16:14:53 +0000 (GMT) (envelope-from robin@reportlab.com) Received: (qmail 36098 invoked from network); 21 Feb 2006 16:14:51 -0000 Received: from unknown (HELO ?192.168.0.3?) (unknown) by unknown with SMTP; 21 Feb 2006 16:14:51 -0000 X-pair-Authenticated: 217.196.247.135 Message-ID: <43FB3C7B.2000307@chamonix.reportlab.co.uk> Date: Tue, 21 Feb 2006 16:14:51 +0000 From: Robin Becker User-Agent: Thunderbird 1.5 (Windows/20051201) MIME-Version: 1.0 To: freebsd-questions@freebsd.org References: <43FAE72D.4000208@chamonix.reportlab.co.uk> <43FAEC1C.7060103@jeremykister.com> In-Reply-To: <43FAEC1C.7060103@jeremykister.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: traffic analysis X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Feb 2006 16:14:53 -0000 Jeremy Kister wrote: > On 2/21/2006 5:10 AM, Robin Becker wrote: >> Our freeBSD 6.0 host is not yet in production, but appears to have outgoing >> traffic of around 140Mb/day; the http logs say 16 hits etc. The host provider >> said this > > 140Mb/day is really not that much. > > Unless my math is wrong because it's past bed time: > 140Mb/day divided by 86400 seconds per day = 0.001 Mb/second (average) > 0.001 Mb/second = 1.659 Kb/second > > this means a dialup modem could handle your average traffic. > > and remember Mb is Megabits, not MegaBytes. > >> "The server is on a /20-network, and this leads to high amounts of >> background traffic (ARP, broadcast, etc.). These traffic types are >> likely to be the reason for most of your outbound traffic." > > Is your server's netmask 255.255.240.0 ??? If it is, call your > provider, laugh at them, and then call a new provider. If your netmask > is not 255.255.240.0, call the person who gave you that line, laugh at > them, and try to find someone more intelligent :) > > You're surely not on a subnet with 4000 hosts. > ifconfig says this vr0: flags=8843 mtu 1500 inet6 xxxx::xxx:xxxx:xxxx:xxxx%vr0 prefixlen 64 scopeid 0x1 inet xx.zz.yy.vv netmask 0xfffff000 broadcast xx.zz.ww.255 ether .............. media: Ethernet autoselect (100baseTX ) status: active so should I be seeking another provider? >> I'm not sure I follow this argument. Does this mean I'm responding to large >> number of spurious requests? The provider's analysis of the input volume is >> pretty small (0Mb). > > If you were on a network with 4000 other machines, it could certainly > cause problems. But i'd bet that someone is just confused -- i'd bet > that their entire network space is a /20, and they have allocated a > small part of it for your network. -- Robin Becker