Re: Ethernet traffic

On Tue, 11 Aug 1998, David J N Begley wrote:

> On Mon, 10 Aug 1998, Ethy H Brito wrote:
>
> > I've been using squid for a couple of months smoothly.
> > About 5 weeks ago I patched it to run mrtg. Since that I've been monitoring
> > the traffic on its ethernet adapter an found a behavior I can't explain:
>
> It's about time this became a FAQ entry, methinks.
>
> > the inbound traffic is equal to the outbound traffic. The differences are
> > neglectable. The hit ratio reports 40%.
> > Shouldn't the outbound be at least 40% greater than the inbound?
> > Any ideas why this is not happening?
>
> I can't account for the exact behaviour you're seeing, but I can offer this
> advice; whenever you start measuring raw Ethernet or IP traffic on
> interfaces, you can forget about getting all the numbers to exactly match what
> Squid reports as the amount of traffic it has sent/received.
>
> Why?
>
> [snip]

Yes, but ...

One of the "bench-nicks" (as opposed to benchmarks - don't want to cause
confusion here ... ;-) of caching is that over some (hopefully short)
period of time, you _should_ see a reduction in the amount of
inbound-traffic on an interface vs the out-bound stuff as a simple way of
gauging the effectiveness of a cache device. It _has_ to be!

Sorry, Dave, I agree with Ethy on this matter.

If you have set up a cache device and have (like I have) stripped most
other services off the said box, then surely the argument for "other"
traffic types being present in the byte counts on an interface doesn't
hold!

Otherwise, what are we doing here? The whole idea of Squid & caching is
to reduce overall amounts of traffic on the 'Net ...

In fact, this effect which Ethy proposes (and unfortunately isn't
observing) IS observable on the caches I run. The NetApp typically shows
a strong correlation between the hitrate reported by the cache management
software and the counts via SNMP on the interface; I see hit rates in the
region of 40%, and guess what? The interface counts on the same box show a
roughly 30-40% difference (typically) between bytes-in and bytes-out!

Now, the NetApp is an appliance and has been specifically tuned for
caching, so I would EXPECT this kind of behaviour... if I hadn't seen it,
I would also be asking questions .... as I (and others) did when
deploying early versions of the Cisco Cache Engines, which, incidently,
_never_ portrayed this phenomenon, and frequently caused an increase in
the load on a network. Go figure.

I have seen the same effect on the interface counts on home routers to my
Squid caches ... that is, the bytes out of the box almost always exceed
the bytes in. As it should.

Ethy, you may need to get a bit more focussed on the issue and try to
determine what traffic is present on the interface you are measuring, and
then what proportion is HTTP, and so on ... to actually determine the
cause of the effect you are observing.

My 5c worth.

J.

----------------------------------------------------
John V Cougar | Voice: 1800 065 744
Cache Manager |-----------------------------
Telstra Internet | E-Mail: cougar@telstra.net
----------------------------------------------------
Received on Tue Aug 11 1998 - 17:03:14 MDT