netstat output - diff between 'link' and 'inet' counters

[Nathan Kinkade]

On Thu, May 20, 2004 at 08:03:58PM +0100, Matthew Seaman wrote:
> On Thu, May 20, 2004 at 11:23:01AM -0600, Nathan Kinkade wrote:
> > I delved into trying to determine the cause of an unreasonably high
> > number of Ierrs on a few FreeBSD routers we have setup on campus.  While
> > probing through the netstat output on the machines I realized that I
> > don't understand the exact difference between the 'inet' and 'link'
> > protocol families.  Now, I understand the difference between IP and
> > ethernet, but the byte and packet counts for 'inet' and 'link' don't
> > seem to match what I would expect for those protocols, respectively.
> > This tells me that the numbers being logged must differ from my
> > expectations.  Generally I notice that the 'inet' counts for an
> > interface are a relatively small fraction of that for the 'link'
> > counts for the same interface.  However, on our main FreeBSD router that
> > provides NAT and access to the internet the numbers are somewhat
> > reversed, with 'inet' counts being much higher than the 'link' counts.
> > Is there someone who can explain to me exactly what packet and byte
> > counts actually represent for the 'inet' and 'link' families?
> 
> I surmise that you're talking about the per-interface statistics as
> reported by 'netstat -i' or 'netstat -I ifN' rather than any other set
> of flags to netstat.  Let's look at what I get on my system:
> 
>     % netstat -I de0
>     Name    Mtu Network       Address              Ipkts Ierrs    Opkts Oerrs  Coll
>     de0    1500 <Link#1>    00:40:05:a5:8d:b7   149504     0   111734     4     0
>     de0    1500 81.2.69.216/2 smtp               70771     -   120940     -     -
>     de0    1500 fe80:1::240 fe80:1::240:5ff:f        0     -        3     -     -
>     de0    1500 81.2.69.219/3 arbitrary         371042     -   301860     -     -
> 
> Now, link#1 corresponds to my local network (from 'netstat -r'):
> 
>     81.2.69.216/29     link#1             UC          2        0    de0
> 
> So the Ipkts count is for all the packets passing that interface with
> a destination address matching the 81.2.69.216/29 network but not
> including packets to one of the specific addresses on that
> interface. That includes many packets for some unused addesses out of
> my netblock[*] and also packets to the broadcast address 81.2.69.219
> 
> The other three entries are for the specific addresses assigned to
> that interface -- I have the principal IP number on the interface as
> 81.2.69.218, and a jail using 81.2.69.219, plus the automatically
> assigned IPv6 link-local address.  (IPv6 traffic mostly goes via a
> gif(4) tunnel which acts like a different interface.
> 
> 	Cheers,
> 
> 	Matthew

Yes, I was referring to netstat's output with the '-i' switch.  The
information you provided is exactly what I was looking for.

Thanks!
Nathan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20040520/66c21fbf/attachment.bin