net.inet.ip.stats - struct ipstat.ips_total - appears to be double the actual number

[Marco van Tol]

Hi there,

I'm trying to write a patch for collectd to generate trend graphs on ipv4 and ipv6 statistics.

I use the sysctls net.inet.ip.stats and net.inet6.ip6.stats for this.

The structs I use to parse these sysctls are "struct ipstat" and "struct ip6stat".

While doing this, I keep running into the fact that the "struct ipstat.ips_total" count seems to be twice the number of ipv4 packets that actually got received on a host.  Does this make any sense at all?

So, in other words, if I call "sysctls net.inet.ip.stats", and do another call 1 second later, I can deduce a per-second incoming ipv4 packet rate.  This seems to be twice as high as actually happening.

The number reported in struct ip6stat.ip6s_total seems to be correct.

Is there any reason for the ips_total to be twice the number of ipv4 packets that actually got received?

Another way to witness these counts is by doing: netstat -s -p ip, and then checkout "total packets received" on a per-second basis.

Thank you very much in advance!

Marco van Tol