Date: Sun, 23 Jun 2019 12:56:45 +0200 From: Marco van Tol <marco@tols.org> To: freebsd-net@freebsd.org Cc: Marco van Tol <marco@tols.org> Subject: Re: net.inet.ip.stats - struct ipstat.ips_total - appears to be double the actual number Message-ID: <1BA006DD-2883-4960-948F-2674E5983AA7@tols.org> In-Reply-To: <7861F570-6FD2-4BD0-B33B-D7F90BE44B77@tols.org> References: <7861F570-6FD2-4BD0-B33B-D7F90BE44B77@tols.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Op 20 jun. 2019, om 22:32 heeft Marco van Tol <marco@tols.org> het = volgende geschreven: >=20 > Hi there, >=20 > I'm trying to write a patch for collectd to generate trend graphs on = ipv4 and ipv6 statistics. >=20 > I use the sysctls net.inet.ip.stats and net.inet6.ip6.stats for this. >=20 > The structs I use to parse these sysctls are "struct ipstat" and = "struct ip6stat". >=20 > While doing this, I keep running into the fact that the "struct = ipstat.ips_total" count seems to be twice the number of ipv4 packets = that actually got received on a host. Does this make any sense at all? >=20 > So, in other words, if I call "sysctls net.inet.ip.stats", and do = another call 1 second later, I can deduce a per-second incoming ipv4 = packet rate. This seems to be twice as high as actually happening. >=20 > The number reported in struct ip6stat.ip6s_total seems to be correct. >=20 > Is there any reason for the ips_total to be twice the number of ipv4 = packets that actually got received? >=20 > Another way to witness these counts is by doing: netstat -s -p ip, and = then checkout "total packets received" on a per-second basis. To briefly come back to this, when I count the components in the output = for "netstat -s -p ip" it adds up to roughly half of total packets = received, like in the following example: -----< sum for the below proto ip >----- 62,770,301 total packets received 1,451,001 + 25,691,568 + 3,719,636 =3D 30,862,205 =3D> Approximately half the total packets received. -----< cut here >----- # netstat -s -p ip ip: 62770301 total packets received 0 bad header checksums 0 with size smaller than minimum 0 with data size < data length 0 with ip length > max ip packet size 0 with header length < data size 0 with data length < header length 0 with bad options 0 with incorrect version number 0 fragments received 0 fragments dropped (dup or out of space) 0 fragments dropped after timeout 0 packets reassembled ok 1451001 packets for this host 0 packets for unknown/unsupported protocol 25691568 packets forwarded (25683102 packets fast forwarded) 3719636 packets not forwardable 0 packets received for unknown multicast group 0 redirects sent -----< cut here >----- While on the same host for IPv6: -----< sum for the below proto ip >----- 5,848,829 total packets received 1,177,571 + 2,489,660 + 1,482,403 =3D 5,149,634 =3D> Much closer to total packets received -----< cut here >----- # netstat -s -p ip6 ip6: 5848829 total packets received 0 with size smaller than minimum 0 with data size < data length 0 with bad options 0 with incorrect version number 0 fragments received 0 fragments dropped (dup or out of space) 0 fragments dropped after timeout 0 fragments that exceeded limit 0 packets reassembled ok 1177571 packets for this host 2489660 packets forwarded 1482403 packets not forwardable 0 redirects sent -----< cut here >----- What am I overlooking? :-) --=20 Marco van Tol
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1BA006DD-2883-4960-948F-2674E5983AA7>