traffic analysis

[Robin Becker]

Jeremy Kister wrote:
> On 2/21/2006 5:10 AM, Robin Becker wrote:
>> Our freeBSD 6.0 host is not yet in production, but appears to have outgoing 
>> traffic of around 140Mb/day; the http logs say 16 hits etc. The host provider 
>> said this
> 
> 140Mb/day is really not that much.
> 
> Unless my math is wrong because it's past bed time:
> 140Mb/day divided by 86400 seconds per day = 0.001 Mb/second (average)
> 0.001 Mb/second = 1.659 Kb/second
> 
> this means a dialup modem could handle your average traffic.
> 
> and remember Mb is Megabits, not MegaBytes.
> 
>> "The server is on a /20-network, and this leads to high amounts of
>> background traffic (ARP, broadcast, etc.). These traffic types are
>> likely to be the reason for most of your outbound traffic."
> 
> Is your server's netmask 255.255.240.0 ???  If it is, call your
> provider, laugh at them, and then call a new provider.  If your netmask
> is not 255.255.240.0, call the person who gave you that line, laugh at
> them, and try to find someone more intelligent :)
> 
> You're surely not on a subnet with 4000 hosts.
>


ifconfig says this

vr0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
         inet6 xxxx::xxx:xxxx:xxxx:xxxx%vr0 prefixlen 64 scopeid 0x1
         inet xx.zz.yy.vv netmask 0xfffff000 broadcast xx.zz.ww.255
         ether ..............
         media: Ethernet autoselect (100baseTX <full-duplex>)
         status: active

so should I be seeking another provider?

>> I'm not sure I follow this argument. Does this mean I'm responding to large 
>> number of spurious requests? The provider's analysis of the input volume is 
>> pretty small (0Mb).
> 
> If you were on a network with 4000 other machines, it could certainly
> cause problems.  But i'd bet that someone is just confused -- i'd bet
> that their entire network space is a /20, and they have allocated a
> small part of it for your network.




-- 
Robin Becker