olivier.nicole at cs.ait.ac.th
Fri Dec 7 03:04:23 UTC 2012
Thank you Matthew and Ilya,
>> There is only one layer 3 network on that physical infrastructure (at
>> least in that VLAN). And there are only 8 machines in that VLAN, no
>> routing, as the VLAN is primarily designed for NFS.
>> I did not sjow the most disturbing figure where at output bytes is 3.7
>> TB at MAC level but only 156 GB at IP level (2000 times less). The
>> large amount of output bytes is understandable for the machine is an
>> NFS server.
>> 3TB is not big, but is at IP level, not at MAC level.
> It could be down to broken equipment attached to the network. If
> something is spewing out malformed packets, you might well see that sort
> of effect.
> Try firing up tcpdump or wireshark -- they'll both capture the layer 2
> traffic and given the volumes you're seeing, it should be fairly obvious
> from visual inspection of the output what is going on.
I tried wireshark with 2 filters:
filter "not ip" shows only spanning tree packets, almost no traffic
filter "ip" shows the bulk of traffic
filter "ip and not host 10.41.170.1" shows no traffic
That was expected.
So I believe it has something to do with the way netstat -i reports the data.
More information about the freebsd-questions