Re: ethernet headers and iptables counters

[Antony Stone <Antony@Soft-Solutions.co.uk>]

On Monday 10 November 2003 11:34 pm, Simon Kitching wrote:

> On Tue, 2003-11-11 at 12:21, Antony Stone wrote:
> > On Monday 10 November 2003 10:25 pm, Marc Lucke wrote:
> > > Antony - my thanks to you.  I rather suspected your answer would be
> > > true.  My problem is that I am getting very large differences in the
> > > usage I track using iptables and the usage that my ISP reports.
> > > iptables reports much more traffic - up to 12% in fact.  I have checked
> > > with the ISP who say they too only count layer 3 IP.
> >
> > 12% is a lot, and the fact that you think you have 12% more traffic than
> > your ISP does is more strange than if it were the other way around.
>
> What about traffic from your host back to itself?

That should go via interface lo, not via eth0.

> For example, GNOME heavily uses the ORBIT corba server, which uses
> TCP/IP to communicate between interacting applications.
>
> Maybe you could add a separate rule for traffic from 127.0.0.1 and to
> your local host address back to the local machine, to measure that?

The routing table entry for 127.0.0.0/8 should send all this traffic via the 
loopback interface - this should not be counted by anything looking at the 
ethernet devices.

Antony.

-- 

In science, one tries to tell people
in such a way as to be understood by everyone
something that no-one ever knew before.

In poetry, it is the exact opposite.

 - Paul Dirac
                                                     Please reply to the list;
                                                           please don't CC me.