little lost with my netstat -m output

[Justin Robertson]

I have a couple of issues that I'm somewhat concerned about based on
some netstat output results.

I have a few boxes running 4.11-STABLE that provide this;

FreeBSD 4.11-STABLE #0: Wed May  4 09:49:52 PDT 2005 (i386)

# netstat -m
netstat: sysctl: retrieving mbstat: Cannot allocate memory



And then two boxes running 5.4-STABLE that provide this;



FreeBSD 5.4-STABLE #0: Wed May 18 11:51:30 PDT 2005 (amd64)

# netstat -m
1358787 mbufs in use
18446744073709476645/32768 mbuf clusters in use (current/max)
0/0/0 sfbufs in use (current/peak/max)
189754 KBytes allocated to network
0 requests for sfbufs denied
0 requests for sfbufs delayed
4735 requests for I/O initiated by sendfile
300 calls to protocol drain routines



FreeBSD 5.4-STABLE #0: Wed May 18 11:51:18 PDT 2005 (amd64)

# netstat -m
740238 mbufs in use
131702/32768 mbuf clusters in use (current/max)
0/0/0 sfbufs in use (current/peak/max)
448463 KBytes allocated to network
0 requests for sfbufs denied
0 requests for sfbufs delayed
10981 requests for I/O initiated by sendfile
492 calls to protocol drain routines


   Now, the 4.11 boxes failing to report and rather giving me a memory
error are somewhat troubling, but what's more troubling is the 5.4 boxes
showing current usage beyond the max limitations. Not to mention
consuming between 190 and 450mb for net traffic. The output just seems
so out of touch... While all the machines are frequented with attacks,
none are in progress at the moment, and the machines rarely suffer
anything more than lag due to network saturation... If this spike was
the result of an attack, why were they never released? I'm generally
confused by what I'm seeing here, what gives?