On Thu, May 20, 2004 at 11:23:01AM -0600, Nathan Kinkade wrote: > I delved into trying to determine the cause of an unreasonably high > number of Ierrs on a few FreeBSD routers we have setup on campus. While > probing through the netstat output on the machines I realized that I > don't understand the exact difference between the 'inet' and 'link' > protocol families. Now, I understand the difference between IP and > ethernet, but the byte and packet counts for 'inet' and 'link' don't > seem to match what I would expect for those protocols, respectively. > This tells me that the numbers being logged must differ from my > expectations. Generally I notice that the 'inet' counts for an > interface are a relatively small fraction of that for the 'link' > counts for the same interface. However, on our main FreeBSD router that > provides NAT and access to the internet the numbers are somewhat > reversed, with 'inet' counts being much higher than the 'link' counts. > Is there someone who can explain to me exactly what packet and byte > counts actually represent for the 'inet' and 'link' families?
I surmise that you're talking about the per-interface statistics as reported by 'netstat -i' or 'netstat -I ifN' rather than any other set of flags to netstat. Let's look at what I get on my system: % netstat -I de0 Name Mtu Network Address Ipkts Ierrs Opkts Oerrs Coll de0 1500 <Link#1> 00:40:05:a5:8d:b7 149504 0 111734 4 0 de0 1500 184.108.40.206/2 smtp 70771 - 120940 - - de0 1500 fe80:1::240 fe80:1::240:5ff:f 0 - 3 - - de0 1500 220.127.116.11/3 arbitrary 371042 - 301860 - - Now, link#1 corresponds to my local network (from 'netstat -r'): 18.104.22.168/29 link#1 UC 2 0 de0 So the Ipkts count is for all the packets passing that interface with a destination address matching the 22.214.171.124/29 network but not including packets to one of the specific addresses on that interface. That includes many packets for some unused addesses out of my netblock[*] and also packets to the broadcast address 126.96.36.199 The other three entries are for the specific addresses assigned to that interface -- I have the principal IP number on the interface as 188.8.131.52, and a jail using 184.108.40.206, plus the automatically assigned IPv6 link-local address. (IPv6 traffic mostly goes via a gif(4) tunnel which acts like a different interface. Cheers, Matthew [*] It's a feature of the way my network is set up that all such packets will hit the de0 interface of that machine. Normally a network switch will prevent irrelevant traffic from hitting that network interface. -- Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way PGP: http://www.infracaninophile.co.uk/pgpkey Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK
Description: PGP signature