From: grahn+nntp@snipabacken.se   
      
   On Wed, 2010-09-29, Rick Jones wrote:   
   > In comp.protocols.tcp-ip Jorgen Grahn  wrote:   
   >> No, it means you should install and use[1] tcpdump to see what this   
   >> actually translates to on the Ethernet level.  Hint: IP fragmentation.   
   >   
   > And/or check the netstat stats from before and after to see if they   
   > report receipt of IP datagram fragments.   
      
   Yes, except if there's lots of activity or the counters are huge   
   already, it can be hard to see what changed.   
      
       That just gave me an idea: it's possible to write a semi-general   
       Unix utility which you run as e.g. "cmd_diff netstat -s" which   
       runs netstat -s, but shows you the difference between now and last   
       time you ran it. If the only difference it sees is in numbers, it   
       can display the numeric delta, otherwise a normal diff(1).   
      
       Wonder why I never thought of it before. I have spent lots of time   
       doing that procedure manually (for various tools) in the past.   
      
   /Jorgen   
      
   --   
     // Jorgen Grahn    O  o   .   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)