Traffic Graphc statistics are backwards for LAN interface
-
Oh, I see what you mean there. Is that the case for the others as well, the actual graph is correct, but the display on the right side with the hosts is backwards?
The RRD data comes from pf's counters rather than netstat (where Status>Traffic Graph pulls), so even if the graph itself were wrong, the RRDs wouldn't likely show the same issue.
-
It has always been like that. The graph is with respect to the pfSense interface - so download traffic goes OUT LAN.
The table of clients is with respect to the client - download traffic is IN to the client.
It needs to be this way, because the clients in the table can also be systems out on the public internet (selecting to show "Remote" or "All"). And in that case it looks sensible that the table shows bandwidth out of some public IP and bandwidth in to some LAN client.As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/ -
It has always been like that. The graph is with respect to the pfSense interface - so download traffic goes OUT LAN.
The table of clients is with respect to the client - download traffic is IN to the client.
It needs to be this way, because the clients in the table can also be systems out on the public internet (selecting to show "Remote" or "All"). And in that case it looks sensible that the table shows bandwidth out of some public IP and bandwidth in to some LAN client.I can see what you're trying to say, but it's still the odd duck with respect to reporting direction. Lemme edit your quote and tell me if this makes more sense:
The table of clients is with respect to the pfsense box - download traffic is OUT to the client.
It needs to be this way, because the clients in the table can also be systems out on the public internet (selecting to show "Remote" or "All"). And in that case it looks sensible that the table shows bandwidth IN from some public IP and bandwidth OUT to some LAN client.Bolded is my edits. If this was the case, it would all match neatly with the rest of the graphs and statistics and rules on pfsense. As it stands right now, if you select WAN, it'll show (for example) 55M bit/sec IN (correct) and when you select LAN, it'll also show 55M bit/sec IN (incorrect).
-
@fyy:
Bolded is my edits. If this was the case, it would all match neatly with the rest of the graphs and statistics and rules on pfsense. As it stands right now, if you select WAN, it'll show (for example) 55M bit/sec IN (correct) and when you select LAN, it'll also show 55M bit/sec IN (incorrect).
You're strictly talking about the display on the right side though, correct?
The rate output there with the host IPs is backwards on LAN. The graph itself is correct.
-
@cmb:
@fyy:
Bolded is my edits. If this was the case, it would all match neatly with the rest of the graphs and statistics and rules on pfsense. As it stands right now, if you select WAN, it'll show (for example) 55M bit/sec IN (correct) and when you select LAN, it'll also show 55M bit/sec IN (incorrect).
You're strictly talking about the display on the right side though, correct?
The rate output there with the host IPs is backwards on LAN. The graph itself is correct.
Yes.
-
It has always been like that. The graph is with respect to the pfSense interface - so download traffic goes OUT LAN.
The table of clients is with respect to the client - download traffic is IN to the client.
It needs to be this way, because the clients in the table can also be systems out on the public internet (selecting to show "Remote" or "All"). And in that case it looks sensible that the table shows bandwidth out of some public IP and bandwidth in to some LAN client.The issue is the opposite. It's showing that "downloading" is "in" for the LAN, when relative to PFSense, it should be "out". I'm seeing 85Mb "in" on the WAN, and 85Mb "in" on the LAN. One should be "in" and the other should be "out".
-
In the table Bandwidth In and Bandwidth Out columns is the perspective of the system listed in the Host Name or IP column on the same row.
So 13.48 Mpbs Out on the pfSense LAN (shown in graph) is 12.4 M Bits/sec Bandwidth In on host 192.168.1.103 (shown in the chart).
And 284 Kbps In on the pfSense LAN (shown in the graph) is 165.81 K Bits/sec Bandidth Out on host 192.168.1.103 (shown in the chart).Is that not correct?
I know this confused me the first time I saw it too. But I think it is correct. Just have to understand the perspectives.
-
I was seeing something like this
WAN 85Mb in / 3Mb out
LAN 85Mb in / 3Mb outMade no sense to me.
-
Well, it's not happening right now…. Maybe I was sleep deprived. I'll check for it over this weekend and see if it happens again.
-
Got it. The graph is showing in/out correctly, but the side value is showing in/out relative to the client.
-
Correct. The bandwidth in/out shown in the table is of the interface listed in the same row.
-
If you really what to twist your brain. Figure this one out.
 -
I see where the confusion is coming in. The graph is relative to the interface but the table is relative to the host.
-
I see where the confusion is coming in. The graph is relative to the pfSense interface but the table is relative to the host interface.
Exactly.
-
If you really what to twist your brain. Figure this one out.
The graph has a "better" longer-term view of the total data in/out on the pfSense interface. The table of clients takes a shorter-term snapshot on each update. Thus the table is just a "rough idea" of what is going on. For clients that are doing something consistent across time it gives a good snapshot of the activity, for clients that do bursty things then it is hit and miss.
Also, anyone making further comments about In/Out please always say if you are talking about the graph or the table - it is very difficult to sort out who is commenting about what.
-
If you really what to twist your brain. Figure this one out.
The graph has a "better" longer-term view of the total data in/out on the pfSense interface. The table of clients takes a shorter-term snapshot on each update. Thus the table is just a "rough idea" of what is going on. For clients that are doing something consistent across time it gives a good snapshot of the activity, for clients that do bursty things then it is hit and miss.
There was only the one client doing anything of significance; copying a 600 MB video to remote client on a 1.5 mbps DSL connection. All the traffic (for practical purpose of this) was to/from that one client.
If I'm correct about what is causing the discrepancy in the numbers (graph LAN In/Out the same and seemingly Out being wildly incorrect, but client table showing correct In/Out values). Something that CMB mentioned earlier is a clue.
@cmb:
The RRD data comes from pf's counters rather than netstat (where Status>Traffic Graph pulls), . . .
-
@phil-davis said in Traffic Graphc statistics are backwards for LAN interface:
It has always been like that. The graph is with respect to the pfSense interface - so download traffic goes OUT LAN.
The table of clients is with respect to the client - download traffic is IN to the client.
It needs to be this way, because the clients in the table can also be systems out on the public internet (selecting to show "Remote" or "All"). And in that case it looks sensible that the table shows bandwidth out of some public IP and bandwidth in to some LAN client.Just quoting this comment because, despite being a nearly 10 year old thread, this is the comment that made it click in my head. I had no idea why the graphs worked this way until Phil explained it. Thank you!
