Date: Mon, 27 Oct 1997 20:15:00 +0100 From: sthaug@nethelp.no To: tom@sdf.com Cc: henrich@crh.cl.msu.edu, Don.Lewis@tsc.tdk.com, matt@3am-software.com, mrcpu@cdsnet.net, freebsd-hackers@FreeBSD.ORG Subject: Re: de0 errors Message-ID: <6841.877979700@verdi.nethelp.no> In-Reply-To: Your message of "Mon, 27 Oct 1997 09:42:52 -0800 (PST)" References: <Pine.BSF.3.95q.971027094146.29011C-100000@misery.sdf.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> > server. I wish FreeBSD had a top or systat function that showed network
> > traffic in K/Sec.
>
> It does: netstat -I de0 -w <poll interval>
Unfortunately, the byte count and the packet count are inconsistent if
the interface is in promiscuous mode - in this case it looks like the
byte count represents the "normal" traffic adressed directly to the
machine, while the packet count represents *all* the traffic that is
seen on the interface, whether it is for this machine or not.
Here is a snapshot of netstat on a Fast Ethernet interface running
nnstat:
input (de6) output
packets errs bytes packets errs bytes colls
20310 0 93115 0 0 0 0
21645 0 94452 0 0 0 0
21904 0 93558 0 0 0 0
18802 0 93293 0 0 0 0
18643 0 94048 0 0 0 0
18732 0 93220 0 0 0 0
The effect is easily reproducible. Start tcpdump (or similar) to force
the interface into promiscuous mode, start netstat -w. Observe the byte
and packet counts. Start ttcp between two other machines on the same
segment, and watch how the packet count climbs to reflect the heavy ttcp
traffic between the other machines, while the byte count doesn't.
Steinar Haug, Nethelp consulting, sthaug@nethelp.no
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6841.877979700>