net.inet.ip.stats - struct ipstat.ips_total - appears to be double the actual number

[Marco van Tol]

Op 20 jun. 2019, om 22:32 heeft Marco van Tol <marco at tols.org> het volgende geschreven:
> 
> Hi there,
> 
> I'm trying to write a patch for collectd to generate trend graphs on ipv4 and ipv6 statistics.
> 
> I use the sysctls net.inet.ip.stats and net.inet6.ip6.stats for this.
> 
> The structs I use to parse these sysctls are "struct ipstat" and "struct ip6stat".
> 
> While doing this, I keep running into the fact that the "struct ipstat.ips_total" count seems to be twice the number of ipv4 packets that actually got received on a host.  Does this make any sense at all?
> 
> So, in other words, if I call "sysctls net.inet.ip.stats", and do another call 1 second later, I can deduce a per-second incoming ipv4 packet rate.  This seems to be twice as high as actually happening.
> 
> The number reported in struct ip6stat.ip6s_total seems to be correct.
> 
> Is there any reason for the ips_total to be twice the number of ipv4 packets that actually got received?
> 
> Another way to witness these counts is by doing: netstat -s -p ip, and then checkout "total packets received" on a per-second basis.

To briefly come back to this, when I count the components in the output for "netstat -s -p ip" it adds up to roughly half of total packets received, like in the following example:

-----< sum for the below proto ip >-----
62,770,301 total packets received
1,451,001 + 25,691,568 + 3,719,636 = 30,862,205
=> Approximately half the total packets received.
-----< cut here >-----
# netstat -s -p ip
ip:
	62770301 total packets received
	0 bad header checksums
	0 with size smaller than minimum
	0 with data size < data length
	0 with ip length > max ip packet size
	0 with header length < data size
	0 with data length < header length
	0 with bad options
	0 with incorrect version number
	0 fragments received
	0 fragments dropped (dup or out of space)
	0 fragments dropped after timeout
	0 packets reassembled ok
	1451001 packets for this host
	0 packets for unknown/unsupported protocol
	25691568 packets forwarded (25683102 packets fast forwarded)
	3719636 packets not forwardable
	0 packets received for unknown multicast group
	0 redirects sent
-----< cut here >-----


While on the same host for IPv6:
-----< sum for the below proto ip >-----
5,848,829 total packets received
1,177,571 + 2,489,660 + 1,482,403 = 5,149,634
=> Much closer to total packets received
-----< cut here >-----
# netstat -s -p ip6
ip6:
	5848829 total packets received
	0 with size smaller than minimum
	0 with data size < data length
	0 with bad options
	0 with incorrect version number
	0 fragments received
	0 fragments dropped (dup or out of space)
	0 fragments dropped after timeout
	0 fragments that exceeded limit
	0 packets reassembled ok
	1177571 packets for this host
	2489660 packets forwarded
	1482403 packets not forwardable
	0 redirects sent
-----< cut here >-----

What am I overlooking? :-)

-- 
Marco van Tol