Re: Ethernet traffic

On Mon, 10 Aug 1998, Ethy H Brito wrote:

> I've been using squid for a couple of months smoothly.
> About 5 weeks ago I patched it to run mrtg. Since that I've been monitoring
> the traffic on its ethernet adapter an found a behavior I can't explain:

It's about time this became a FAQ entry, methinks.

> the inbound traffic is equal to the outbound traffic. The differences are
> neglectable. The hit ratio reports 40%.
> Shouldn't the outbound be at least 40% greater than the inbound?
> Any ideas why this is not happening?

I can't account for the exact behaviour you're seeing, but I can offer this
advice; whenever you start measuring raw Ethernet or IP traffic on
interfaces, you can forget about getting all the numbers to exactly match what
Squid reports as the amount of traffic it has sent/received.

Why?

Squid is an application - it counts whatever data is sent to, or received
from, the lower-level networking functions; at each successively lower layer,
additional traffic is involved (such as header overhead, retransmits and
fragmentation, unrelated broadcasts/traffic, &c.). The additional traffic is
never seen by Squid and thus isn't counter - but if you run MRTG (or any
SNMP/RMON measurement tool) against a specific interface, all this additional
traffic will "magically appear".

Also remember that an interface has no concept of upper-layer networking (so
an Ethernet interface doesn't distinguish between IP traffic that's entirely
internal to your organisation, and traffic that's to/from the Internet); this
means that when you start measuring an interface, you have to be aware of
*what* you are measuring before you can start comparing numbers elsewhere.

It is possible (though by no means guaranteed) that you are seeing roughly
equivalent input/output because you're measuring an interface that both
retrieves data from the outside world (Internet), *and* serves it to end users
(internal clients). That wouldn't be the whole answer, but hopefully it gives
you a few ideas to start applying to your own circumstance.

Cheers..

dave
Received on Tue Aug 11 1998 - 05:04:35 MDT