netstat -i output

[Reid Linnemann]

Written by Tom Worster on 06/02/07 05:00>>
> i'm confused by the output from netstat -i:
> 
> Name    Mtu Network       Address            Ipkts Ierrs Ibytes Opkts Oerrs Obytes  Coll
> bge0   1500 <Link#1>      00:30:48:5e:56:8a  7.4M  1.2K   4.9G  2.9M     0  2.6G    0 
> bge0   1500 65.39.221/24  www1               2.9M     -   414M  3.0M     -  2.5G    - 
> 
> it lists the same interface twice. what is the difference between these two?
> 
> this is a web server so wny so much more input bytes than output?
> 
> _______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"

The first is the ethernet address family, the other is ipv4.

If you notice, your ipv4 statistics show 414Mb in ang 2.5 Gb out, with 
roughly a 1:1 ratio of input and output packets. This would seem 
logical, since http is a request:response protocol. Remember that IP is 
a network layer protocol, which is mainly facilitated by the ethernet 
data link layer protocol, but ethernet is not simply relegated to 
servicing IP communications, many other services and protocols use 
ethernet. For instance, many blade/rack systems these days use some sort 
of network console over ethernet, which I would assume generates far 
less input bytes than output bytes on the machines. This is just one 
example, there's far more things that use ethernet than I can be aware of.