kev_245_28249
Nimbostratus
Feb 28, 2011

# b tmm output and b tcp stats show output how best to decypher?

Hi, I have a few questions here in regards to comprehending the output of the 'b show' commands.

1/ b tmm

I'm trying to determine some %'s from the 'b tmm' output. Such as 'no listen' denials. I would like to be able to work out the % or at least explain what a number such as 1287 (below) refers to in terms of frequency.

Eg

denials (maint, addr full, serv full) = (0, 0, 0)

| (no serv, no listen, no mem, no lic) = (0, 1287, 0, 0)

2/ b tmm

Can anyone explain what the letters stand for in b output commands, such as 'M' and 'G', and 'T'.

Mega packets, Mega bits??

eg

server (pkts,bits) in = (20.13M, 15.99G), out = (19.25M, 40.19G)

3/ b tcp stats show all - rxooseg sol6523 tells me this is of connections that received an out of order TCP segment. How does one give this number more meaning? (Ie versus in order segments.)

GLOBAL TCP STATISTICS

| Conn (open, CLOSE-WAIT) = (15, 0)

| Conn (FIN-WAIT, TIME_WAIT) = (0, 0)

| Conn (accept, not accept) = (56, 0) (estab, fail) = (37, 0)

| Conn (abandon, expire) = (0, 3) Resets = 13 Bad cksm = 0

| (rxbadseg, rxooseg, txrexmits) = (0, 53855, 157)

Regards,

Evan

### 4 Replies

• Hi Evan,

1) I think 'no listen' denials are a count of packets (syn's?) received on an IP:port that no virtual server or other object is configured to listen on. So I don't think it's necessarily relevant to look at the number of successful connections to an IP:port TMM is listening on. Regardless, you can get a count of connections accepted since the stats were reset by looking at the 'b tmm show all' output:

b tmm show

TMM 0.0 process 7118 on CPU 0 TMM id 0 Total TMMs = 1

| client (cur, max, limit, tot) = (1, 27459, 0, 236420) <---- connections

| client (pkts,bits) in = (1.145M, 644.2M), out = (911943, 592.7M)

| server (cur, max, limit, tot) = (1, 1, 0, 49)

| server (pkts,bits) in = (5725, 2.152M), out = (0, 0)

| TMM cycles (total, idle, sleep) = (76.17T, 11.05T, 63.88T)

| denials (maint, addr full, serv full) = (0, 0, 0)

| (no serv, no listen, no mem, no lic) = (0, 30105, 0, 0)

2) You're correct: M stands for a million, G stands for billion, T stands for a trillion (packets, bits, bytes or whatever the unit is for the specific stat you're looking at).

http://en.wikipedia.org/wiki/SI_prefix

3) Again, the 'b tmm show all' output shows the total number of clientside and serverside connections received. If rxooseg is "the number of connections that received an out of order TCP segment" you could compare that to the sum of these two connection totals.

Aaron
• Thanks for the reply. A couple more questions:

1/ Do you know if TMM 0.0 passes different traffic to the other 3 CPU's? Reason I ask is that, all the traffic load appears to be well spread between all 4 CPU's, but , TMM 0.0 has 6.5M no listens on incoming stats below, where as the other 3 CPU's only have about 1000 no listens. All other stats appear equal:

TMM 0.0:

client (pkts,bits) in = (47.77M, 31.95G), out = (35.78M, 90.63G)

(no serv, no listen, no mem, no lic) = (0, 6.535M, 0, 0)

TMM 0.1

client (pkts,bits) in = (54.16M, 38.91G), out = (41.49M, 98.37G)

(no serv, no listen, no mem, no lic) = (0, 846, 0, 0)

2/ how would you correlate the following output? For eg resets 145283/495710? Or rxooseg of 8.103M/xxxx ?

GLOBAL TCP STATISTICS

| Conn (open, CLOSE-WAIT) = (26, 0)

| Conn (FIN-WAIT, TIME_WAIT) = (0, 0)

| Conn (accept, not accept) = (495710, 0) (estab, fail) = (494920, 80)

| Conn (abandon, expire) = (17, 5392) Resets = 145283 Bad cksm = 0

| (rxbadseg, rxooseg, txrexmits) = (0, 8.103M, 1.198M)

• I would guess the uneveness has something to do with the hashing algorithm that determines which TMM receives the packets and the specific type of traffic that's being sent to an IP:port which doesn't have a listener defined. I'm not sure exactly why that would happen though. If you'd like to find out more about this, you could open a case with F5 Support.

Aaron
• Ok will do. what do you think about the ratio? Am I correct in saying:

6M/47M is the ratio for no listens?