What is the difference between bandwidth and packets/s?
Short answer
Bandwidth is the amount of data that passes through an interface per second (bytes/second in TR7 graphs); packets/s is the number of packets that pass per second. The two measure the same traffic from different angles: a large file transfer produces high bandwidth with a small number of large packets; a large number of small requests or a SYN flood, on the other hand, produces high packets/s even at low bandwidth. In TR7, these values are drawn separately in the Network Bandwidth (RX Traffic, TX Traffic) and Network Packets (RX Packets, TX Packets) panels on the Dashboard screen of the interface; the device-wide totals are in the Total Network Bandwidth and Total Network Packets panels on the Network tab of the home page. The Interfaces tab of the Left Monitor Panel shows the Network Bandwidth metric by default.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Left Monitor Panel → Interfaces → interface → Dashboard (Traffic, Packets tabs) | Network Bandwidth, Network Packets | Bandwidth and packets/s per interface, RX and TX separately |
| Home → Network tab | Total Network Bandwidth, Total Network Packets | Device-wide total |
| Left Monitor Panel → Interfaces → View Settings | Primary Metric (default Network Bandwidth, Total data); Network Packets can also be selected | Listing the interfaces by traffic volume or by packet count |
| Network → Route Tables | Total Traffic column | The instant received and sent bandwidth passing through the route table |
| vService form (HTTP, L7 TCP) → Details | Bandwidth | Putting a limit on the total traffic of the vService going to the clients (Can I limit bandwidth (download / upload)?) |
Comparison
| Bandwidth | Packets/s | |
|---|---|---|
| What it measures | Data passing per second (bytes) | Packets passing per second |
| Typical case where it is high | Large file, video, backup | Many small requests, DNS, SYN flood |
| Bottleneck | Link capacity (e.g. 1 Gbps) | Processor and interrupt load |
| TR7 panel (interface) | Network Bandwidth | Network Packets |
The average packet size is found by dividing bandwidth by the packets/s value; a sudden drop in this ratio points to traffic made up of small packets.
Common Misconceptions
- "If bandwidth is low, the device is not under load." Intense traffic made up of small packets puts pressure on the packets/s value and the processor; the rules against L4 attacks also work according to packet and connection rates (L4 DDoS Protection).
- "The two graphs show the same thing." One measures the data volume, the other the packet count; they are read together.
- "In a cluster, the graph shows the two devices separately." The graph views of the interface Dashboard sum the data of the two devices; to separate the devices, the Stat Table view is used (Traffic, Packets and Errors tabs).
How it is done in the documentation
