[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: pfstat and size of packets

On Sat, Dec 04, 2004 at 12:28:50PM +0100, Tobias Walkowiak wrote:
> what is the exact size of packets logged by pfstat? is the MTU meant or the
> size of a IP packet? how can i equal the number of packets with the actual
> number of bytes passed?
pfstat logs the counters shown by pfctl -si. The 'bytes' counters are
the sum of packet sizes (IP and TCP/UDP/ICMP headers and payload). If
you run tcpdump on the logged interface, you'll see packets in the same
form, i.e. the hexdump shows the size of the packets as pf counts it.
The 'packets' counter simply counts the number of packets. You can
divide the bytes counter by the packet counter, and you'll get the
average size of a packet. There is not other relation. The MTU is
irrelevant, except that your average packet size will likely be lower
than the MTU of the interface ;)