[mrtg] Re: outies and innies part II

[Adam Augustine]

Traffic on each interface represents two directions, as you have shown below
and has been discussed. What is those numbers are showing is a large amount
of traffic flowing out from r1, and into e1 (connected by a wire), the AP is
forwarding traffic in from e1 and out from d1 to the clients.

So to answer your questions:

1) It represents both. Packets that are counted "out" from r1 are counted
"in" on e1, because they are directly connected by a wire. r1 and e1 should
be equal but opposite since they are on the same wire and see exactly the
same traffic in exactly the same framing format (which the numbers below
show, at least close enough for any difference to be explained away by
rounding error or packets corrupted on the wire). The opposite is also true,
"out" from e1 are shown as "in" on r1.

It is slightly different when you are passing through a switch however,
because the switch examines the packet and makes a decision whether or not
to forward the layer 3 packet.

If a packet is destined for a wireless client is received on e1, it is
counted "in" on e1. The AP then decides to forward the packet (or not), and
it is counted "out" on d1. If the AP decided not to forward the packet, it
would have only been counted "in" on e1.

If a packet is from a wireless client to a wired client, then it is counted
"in" on d1. Then the AP decides to forward the packet (or not) then it is
reframed, sent "out" e1 and is counted "out" on "e1" (and then "in" on r1).

If a packet is sent from a wireless client and it is a broadcast packet, it
is counted "in" on d1, the AP replicates it and sends it out e1 and back out
d1, and so is counted twice on d1 (once for "in", once for "out") and once
on e1 (once for "out) and once on r1 (once for "in"). This is one of the
curiosities of how APs act as relays for all clients.

2) the "Out" part of d1 shows out to clients, yes. So there is a large
number of packets flowing from something (the server presumably) behind r1,
"Out" of r1, "In" to e1, "Out" from d1, and "In" to c1 (the client). Lets
say s1 is the server's Ethernet interface, and r2 is another port on the
switch we have labeled "r". If the server sends a packet to our client, it
will go "out" s1, "in" r2 (where the server is plugged into the switch),
"out" r1 (where the AP is plugged in to the switch), "in" e1, out "d1"
(where the client is connected to the AP), in "c1".

So yes, the server is sending data to the wireless client(s).

Something to note as an aside:

d1 (the wireless side) will not always reflect exactly the same byte counts
on the e1 side because the traffic and framing format may (will) be
different.

The reason for different traffic is that the access point itself is going to
be doing some filtering. The AP should not pass traffic that originates on
the wireless side and is destined for the wireless side (client to client)
to the wired side. Most APs act as switches rather than hubs. Same is true
for wired side clients sending traffic to wired side clients that the AP may
see (it shouldn't ever see this traffic in theory since r1 should not be
sending it, but it might if r1 were actually a hub).

Framing is different on 802.11 than on 802.3 Ethernet, as well. The headers
are much larger in 802.11, so interface byte counts tend to be larger on an
802.11 interface for exactly the same layer3 packet that goes out (or in) on
a wire.

Hope that helps,
	Adam


-----Original Message-----
From: Matt Katona [mailto:mkatona at comwavz.com]
Sent: Tuesday, June 04, 2002 8:11 AM
To: mrtg at list.ee.ethz.ch
Subject: [mrtg] outies and innies part II



Thanks to all that replied.

Next question. What about Cisco aironet devices?

They have two interfaces: e1 and d1

e1 is the Ethernet pointing to the switch (r1). Simple enough
d1 is the radio wave side of the device which clients are connecting to via
801.11b.

What I am seeing is this:
r1 shows a rate of: In: 72.6 kb/s & Out: 1151.3 kb/s
e1 shows a rate of: In: 1152.1 kb/s & Out: 77.7 kb/s
d1 shows a rate of: In: 83.3 kb/s & Out: 1139.6 kb/s


So does d1 represent the traffic from e1 or does it represent the traffic of
the clients which are on the radio wave?
If the d1 is infact out to clients, then we have a case of a server fulling
requests(blue line graph)? Does this sound correct?

--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
Archive     http://www.ee.ethz.ch/~slist/mrtg
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi

--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
Archive     http://www.ee.ethz.ch/~slist/mrtg
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi