Measuring data transferred through an interface?

[Matthew Seaman]

--liOOAslEiF7prFVr
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Feb 22, 2003 at 01:50:41PM +0000, Jonathan Belson wrote:

> >If all you want is the total number of bytes transferred, you can run:
> >
> >    % netstat -ib
> >
> >to get packet and byte IO counts since the last reboot.  A script to
> >convert that into daily usage is left as an exercise for the student.
>=20
> I was just about to bash a cgi script together to display my daily
> usage when I noticed the following:
>=20
> jon at dookie:~/projects/traffic# netstat -ib
> Name  Mtu   Network       Address            Ipkts Ierrs     Ibytes   =20
> Opkts Oerrs     Obytes  Coll
> fxp0  1500  <Link#1>    00:a0:c9:4b:f1:d1  1338614     0  288456851 =20
> 1594383     2 1395070738     0
> fxp0  1500  192.168.0     dookie            545200     -  182806557  =20
> 720803     -  575157882     -
> xl0   1500  <Link#2>    00:60:08:4f:f6:f8  5305296   182 1511513823 =20
> 1790630     5  834108098     0
> xl0   1500  pc2-rdng1-4-c pc2-rdng1-4-cus   910272     -  459643920 =20
> 1790514     -  809033696     -
> ppp0* 1500  <Link#3>                             0     0          0      =
 =20
> 0     0          0     0
> lo0   16384 <Link#4>                        222481     0   44749326  =20
> 222481     0   44749326     0
> lo0   16384 your-net      localhost         195212     -   35658820  =20
> 195220     -   35659674     -
>=20
> Each network interface appears twice, with different ibytes/obytes.  What=
 is
> the significance of the two values?

The <Link#x> line shows the total number of packets/bytes transmitted
through that interface at the ethernet level.

Beneath that, there are lines for each of the IP addresses associated
with the interface, showing the protocol specific counts of numbers of
packets/bytes transiting that interface and associated with the
corresponding network address.

The difference between the link level counts and the address specific
counts is due to packets not using any of the listed IPv4 or IPv6
address ranges.  This can be due to all sorts of things, like running
alternate network protocols like Appletalk or SMB, or packets
addressing at the ethernet level, like the DHCP broadcast packets to
ff:ff:ff:ff:ff:ff or running an interface in promiscuous mode, or
multicast packets, or routing packets for networks not directly
connected to your machine.  You can see some more info about multicast
traffic by running:

    netstat -iba

Generally it's the link level count that will tell you how much
traffic your interface is dealing with.

	Cheers,

	Matthew


--=20
Dr Matthew J Seaman MA, D.Phil.                       26 The Paddocks
                                                      Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey         Marlow
Tel: +44 1628 476614                                  Bucks., SL7 1TH UK

--liOOAslEiF7prFVr
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (FreeBSD)

iD8DBQE+V4rLdtESqEQa7a0RAtJ4AKCdjMfeik2b5rNjdTLwit9IQlVb9wCfdlSw
H6GHWMnSm+p5aiyid3cwGKY=
=lJtq
-----END PGP SIGNATURE-----

--liOOAslEiF7prFVr--