Re: iptables / traffic accounting
On 05/13/2003 05:48:43 AM "Dreimann, Philipp" wrote:
>> My Provider uses for its accounting data from Cisco Routers.
>>
>> And here is my problem: The traffic i'm logging using my iptables rules
>> is 5-6% lesser than the data my provider is logging.
>>
>> Has anyone an idea from where my provider could get the additional 5-6%
>> traffic? Or where i lose the 5-6% ?
Need more data, but probably encapsulation. I'm guessing your provider
looks at raw interface stats.
Look at OSI model.
If you're running frame relay, each IP packet will be encapsulated into a
frame w/ header and CRC.
If you're running ATM each IP packet will be split into little 48 byte
cells with 5 bytes of header.
PPP has some (limited) overhead, depending on how often it reauthenticates,
etc.
Cisco HDLC has a peculiar SNAP like encapsulation to carry multiple
protocols.
SLIP is probably the lowest overhead I can think of.
Look on the bright side, when you encap to run over ethernet, you're adding
headers to run on the ethernet.
So, 10.00000 megs of serial HDLC will be mighty close to 10.00000 megs of
ethernet, even if it is only 9.99999 megs of IP.
This is all assuming it's a technical problem and you're not dealing with a
provider that "pads the bills".
Reply to: