netstat -i

[Matthew Seaman]

On 06/12/2012 05:51, Olivier Nicole wrote:
> I used netstat -i for the first time and I saw something I cannot
> understand:
> 
> # netstat -ibh -I em1
> Name    Mtu Network       Address              Ipkts Opkts
> em1    9000 <Link#2>      00:0e:0c:5c:32:29      92M  129M
> em1    9000 10.41.170/24  ufo2000               924K  926K
> 
> I understand that the line reporting MAc address means the traffic
> seen at layer2, while the line reporting IP address means the traffic
> seen at layer3.
> 
> How would that be possible to have suh a difference (on a switched
> network)?

It's certainly possible -- arp (and dhcp to some extent) involve sending
broadcast packets at layer 2.  There can be a lot of arp traffic on a
well-populated network, or if you're going things like running multiple
layer 3 networks over the same physical infrastructure.  There can be
other forms of Ethernet-only (rather than IP traffic) -- switches often
speak to each other like that.  Generally it is not a problem unless it
is affecting performance, at which point the answer is to segment the
network into smaller broadcast domains by sub-netting and/or using VLANs.

	Cheers,

	Matthew