- Posts: 163
- Thank you received: 0
Network Interface bytes sent a second.
20 years 9 months ago #2626
by Kn1ght
Thanks
Network Interface bytes sent a second. was created by Kn1ght
Okay, I'm sorry you guys I'm still getting problems understanding this Counter. I am getting numbers like this on peak hours.
:roll:
81.24860611
3096.255892
11171.00806
12180.76351
15817.96378
8613.332881
11558.96245
5442.86367
5651.387585
5633.434455
5465.017684
4641.923854
12273.207
2544.055093
4732.232461
1582.106161
1279.949837
:shock:
The highest number I got on our file server over a week period was 8,029,103.093
How can only 88 bytes a second or even 5k be normal? however my boss says that this is fine. Am I missing something??!
Thank you
Kn1ght the confused.
:roll:
81.24860611
3096.255892
11171.00806
12180.76351
15817.96378
8613.332881
11558.96245
5442.86367
5651.387585
5633.434455
5465.017684
4641.923854
12273.207
2544.055093
4732.232461
1582.106161
1279.949837
:shock:
The highest number I got on our file server over a week period was 8,029,103.093
How can only 88 bytes a second or even 5k be normal? however my boss says that this is fine. Am I missing something??!
Thank you
Kn1ght the confused.
Thanks
20 years 9 months ago #2627
by Chris
Chris Partsenidis.
Founder & Editor-in-Chief
www.Firewall.cx
Replied by Chris on topic Re: Network Interface bytes sent a second.
Knight,
The values you posted could be valid on server, even on peak hours. This depends on the number of users connected to the server and tasks performed during the time your monitoring the server.
I just ran the performance monitor on my laptop here in the office and observed the received and sent byte counter and saw values similar to the ones you posted.
For example, when I didn't do anything on the network, the bytes received counter would hop from 20.000-680.000 which translates to 20 bytes and 680 bytes.
Note that this is the information received on the actual network card, disregarding who it's meant for. So the above values represent ALL type of traffic that's on the network - this includes broadcasts, multicasts e.t.c
After that, I fired my remote control software and connected to one of our many servers and did some work on it to see the numbers my counter would present .. and they reached 60600.000 (60 kb/sec).
Coming to the largest number you got, 8,029,103.093 , that comes out to 8mb/sec, which is totally acceptable for a machine. Obviously, your server has a 100Mbit network connection
If this post hasn't answered your question, let us know exactly which part is confusing you.
Cheers,
The values you posted could be valid on server, even on peak hours. This depends on the number of users connected to the server and tasks performed during the time your monitoring the server.
I just ran the performance monitor on my laptop here in the office and observed the received and sent byte counter and saw values similar to the ones you posted.
For example, when I didn't do anything on the network, the bytes received counter would hop from 20.000-680.000 which translates to 20 bytes and 680 bytes.
Note that this is the information received on the actual network card, disregarding who it's meant for. So the above values represent ALL type of traffic that's on the network - this includes broadcasts, multicasts e.t.c
After that, I fired my remote control software and connected to one of our many servers and did some work on it to see the numbers my counter would present .. and they reached 60600.000 (60 kb/sec).
Coming to the largest number you got, 8,029,103.093 , that comes out to 8mb/sec, which is totally acceptable for a machine. Obviously, your server has a 100Mbit network connection
If this post hasn't answered your question, let us know exactly which part is confusing you.
Cheers,
Chris Partsenidis.
Founder & Editor-in-Chief
www.Firewall.cx
20 years 9 months ago #2629
by Kn1ght
Thanks
Replied by Kn1ght on topic Re: Network Interface bytes sent a second.
okay, so why isn't it close to 100MB a second that is why I'm confused. Or because it is only sent shouldn't it be close to 50%? I will go to our server, make it work it's tail off, go to an end computer and I get 8mb a second. I know that 100mb/sec is only theory but still.....
Thanks you guys are awesome (Yet again)
Thanks you guys are awesome (Yet again)
Thanks
20 years 9 months ago #2631
by sahirh
Sahir Hidayatullah.
Firewall.cx Staff - Associate Editor & Security Advisor
tftfotw.blogspot.com
Replied by sahirh on topic Re: Network Interface bytes sent a second.
100 megabits per second....
not megabytes
Are you getting around ~12 MB as opposed to Mb (note the big and small).. then you're doing aright... if its a non switched network..
not megabytes
Are you getting around ~12 MB as opposed to Mb (note the big and small).. then you're doing aright... if its a non switched network..
Sahir Hidayatullah.
Firewall.cx Staff - Associate Editor & Security Advisor
tftfotw.blogspot.com
20 years 9 months ago #2634
by sahirh
Sahir Hidayatullah.
Firewall.cx Staff - Associate Editor & Security Advisor
tftfotw.blogspot.com
Replied by sahirh on topic Re: Network Interface bytes sent a second.
One more thing, the bandwidth doesn't split 50% upload and download traffic.. downloads usually max out, whereas uploads never really get going..
This happens because of TCP.. the upload is just being used for acknowledgement of data.. with SACK (selective acknowldgement) there are very few ACK packets required. Furthermore, these days LANs are much better made.. collisions and frame corruption happen a lot less.. and networks are better set up, so retransmission of data is minimised.
Yknow what is the most educative experience.. its to just watch a network sniffer in real time.. I have recommended this to lots of people because its one of the only two ways to learn technology.
The second way is to program it. If you can code a firewall from the ground up, you'll know how they work inside out. The reason these two techniques are the only way is because life is all very peachy in the RFCs and according to the standards layed down. The real world invariably doesn't work the same way.
It depends on which method pushes your buttons. I learned my core networking by just watching packets fly by.. not the decodes, the raw hex.. after a while you'll learn to spot common patterns.. like three way handshakes.. the windows NetBIOS traffic (look for alternating 41 43 41 43 41 43 in the hex.. it corresponds to CACACA which is used as padding for NetBIOS names). Soon stuff like this
FHEPFCELEHFCEPFFFACACACACACACACA will instantly read as 'Workgroup'. Now I'm rebuilding all my knowledge by coding it all.. and I find my understanding is becoming even clearer. I understand things at the bit level because of the coding, and I understand the big picture because of the networking.
God I'm so off topic,.. tfs please moderate me !
This happens because of TCP.. the upload is just being used for acknowledgement of data.. with SACK (selective acknowldgement) there are very few ACK packets required. Furthermore, these days LANs are much better made.. collisions and frame corruption happen a lot less.. and networks are better set up, so retransmission of data is minimised.
Yknow what is the most educative experience.. its to just watch a network sniffer in real time.. I have recommended this to lots of people because its one of the only two ways to learn technology.
The second way is to program it. If you can code a firewall from the ground up, you'll know how they work inside out. The reason these two techniques are the only way is because life is all very peachy in the RFCs and according to the standards layed down. The real world invariably doesn't work the same way.
It depends on which method pushes your buttons. I learned my core networking by just watching packets fly by.. not the decodes, the raw hex.. after a while you'll learn to spot common patterns.. like three way handshakes.. the windows NetBIOS traffic (look for alternating 41 43 41 43 41 43 in the hex.. it corresponds to CACACA which is used as padding for NetBIOS names). Soon stuff like this
FHEPFCELEHFCEPFFFACACACACACACACA will instantly read as 'Workgroup'. Now I'm rebuilding all my knowledge by coding it all.. and I find my understanding is becoming even clearer. I understand things at the bit level because of the coding, and I understand the big picture because of the networking.
God I'm so off topic,.. tfs please moderate me !
Sahir Hidayatullah.
Firewall.cx Staff - Associate Editor & Security Advisor
tftfotw.blogspot.com
Time to create page: 0.133 seconds