From owner-freebsd-questions@FreeBSD.ORG Tue Feb 21 16:17:01 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A8BFD16A420 for ; Tue, 21 Feb 2006 16:17:01 +0000 (GMT) (envelope-from danial_thom@yahoo.com) Received: from web33307.mail.mud.yahoo.com (web33307.mail.mud.yahoo.com [68.142.206.122]) by mx1.FreeBSD.org (Postfix) with SMTP id 4144743D45 for ; Tue, 21 Feb 2006 16:17:01 +0000 (GMT) (envelope-from danial_thom@yahoo.com) Received: (qmail 15901 invoked by uid 60001); 21 Feb 2006 16:17:00 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:Received:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=3TpWrnypMzTBxiifR5kw/FTWL+dsGtkAYg7B8ljhnIQGFWPWZngZNyqPprIom+7VXt0EQjHfl64i87X0Bto5UNDscR3s08bgRr6dDCn3fqvp41mRWPHwDcygYeYVrrLMsSDn1pNE0U7JtOeHVmFxQpUekm0E2nWQqtP7ePGb6r4= ; Message-ID: <20060221161700.15895.qmail@web33307.mail.mud.yahoo.com> Received: from [24.46.186.215] by web33307.mail.mud.yahoo.com via HTTP; Tue, 21 Feb 2006 08:17:00 PST Date: Tue, 21 Feb 2006 08:17:00 -0800 (PST) From: Danial Thom To: Jeremy Kister , freebsd-questions@freebsd.org In-Reply-To: <43FAEC1C.7060103@jeremykister.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Cc: Subject: Re: traffic analysis X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: danial_thom@yahoo.com List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Feb 2006 16:17:01 -0000 --- Jeremy Kister wrote: > On 2/21/2006 5:10 AM, Robin Becker wrote: > > Our freeBSD 6.0 host is not yet in > production, but appears to have outgoing > > traffic of around 140Mb/day; the http logs > say 16 hits etc. The host provider > > said this > > 140Mb/day is really not that much. > > Unless my math is wrong because it's past bed > time: > 140Mb/day divided by 86400 seconds per day = > 0.001 Mb/second (average) > 0.001 Mb/second = 1.659 Kb/second > > this means a dialup modem could handle your > average traffic. > > and remember Mb is Megabits, not MegaBytes. > > > "The server is on a /20-network, and this > leads to high amounts of > > background traffic (ARP, broadcast, etc.). > These traffic types are > > likely to be the reason for most of your > outbound traffic." > > Is your server's netmask 255.255.240.0 ??? If > it is, call your > provider, laugh at them, and then call a new > provider. If your netmask > is not 255.255.240.0, call the person who gave > you that line, laugh at > them, and try to find someone more intelligent > :) > > You're surely not on a subnet with 4000 hosts. Laughing at your cable company will get you nowhere fast. That is a fairly typical subnet mask for a large cable network. Cable companies usually have larger networks than say, guys who hang out on the freebsd-questions list. Now on a cable network you'll see tons of INCOMING traffic (I get about 40pps of ARPS continuously), but you shouldn't be responding to them you can use tcpdump -i INTERFACE_NAME src YOUR_ADDRESS to quickly view the traffic going out of your machine. DT __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com