Hi, I know this is slightly off topic but it is really the best place to ask.. I am using Shorewall on my colocated webserver / mail server, I am using the data from /proc/net/dev to graph the network (eth0) traffic with MRTG.. Since it is colocated I pay for the amount of data transfer that my server sends and receives.. My ISP also uses MRTG to graph the traffic that is being sent and received by my server using stats on their switch, I think it is done using my servers MAC address or using the physical port on the switch.. Anyway, the problem is that the ISP''s graph shows much higher peaks in the graph than my graphs show yet we are both graphing on a 5 min average.. I think I know the answer to this but I though I would ask anyway.. Would Shorewall (or more correctly iptables) have any effect on the received and transmitted bytes shown in /proc/net/dev?? and a more ambiguous question.. Anyone got any ideas as to why my graph and my ISP''s graph are coming up so differently (they say they have checked the settings on their system and believe that they are in fact graphing the correct MAC address and switch port for my server)?? Thanks..
WipeOut wrote:> > I think I know the answer to this but I though I would ask anyway.. > > Would Shorewall (or more correctly iptables) have any effect on the > received and transmitted bytes shown in /proc/net/dev??I can''t imagine how.> > and a more ambiguous question.. > > Anyone got any ideas as to why my graph and my ISP''s graph are coming up > so differently (they say they have checked the settings on their system > and believe that they are in fact graphing the correct MAC address and > switch port for my server)?? >Are you seeing a divergence in the packet counts and transfer counts or just in the transfer counts? -Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \ http://shorewall.net Washington USA \ teastep@shorewall.net
Tom Eastep wrote:> WipeOut wrote: > > >> >> and a more ambiguous question.. >> >> Anyone got any ideas as to why my graph and my ISP''s graph are coming >> up so differently (they say they have checked the settings on their >> system and believe that they are in fact graphing the correct MAC >> address and switch port for my server)?? >> > > Are you seeing a divergence in the packet counts and transfer counts > or just in the transfer counts? >Unfortunately I can''t see the packet counts on the ISP''s side so I am not able to make that comparison.. I can only see the transfer information.. So far it looks to me like they have a problem with their system which, if it is the case, could mean that they have been over charging all their customers for bandwidth provided the problem is common to all their customers.. Later..
On Tue, 2004-05-04 at 21:18 +0100, WipeOut wrote:> Tom Eastep wrote: > > > > Unfortunately I can''t see the packet counts on the ISP''s side so I am > not able to make that comparison.. I can only see the transfer information.. > > So far it looks to me like they have a problem with their system which, > if it is the case, could mean that they have been over charging all > their customers for bandwidth provided the problem is common to all > their customers.. > > Later..This would be why I''ve always recommended to clients that they monitor their own information and do not rely on what the ISP will provide. Especially in cases where you ''pay by the drink'', it is to the ISPs advantage to dwiddle the numbers just a bit, maybe throw in additional traffic to count for ''routing overhead'' or other BS. On the less cynical side, depending on what your connection is like, maybe they pick up traffic that you don''t see on your side such as ARP broadcasts from their net that doesn''t traverse down your connection or the like. -- David T Hollis <dhollis@davehollis.com>