[Orca-dev] Couple of minor updates - make sure I'm not smokin' something

[Sean O'Neill]

Curious if folks could qualify my assumptions for some modifications 
I've made to the orcallator.se script.

TCP per Packet "Data" Size:
http://www.seanoneill.info/orca/o_gauge_tcp_InDt_per_p,o_gauge_tcp_OutDt_per_p-hourly.html

This attempts to show how big the data payload is for each TCP packet 
both for incoming and outgoing.  This isn't computed with the time 
interval in mind.  This is purely taking the amount of data 
received/transmitted during the time interval and dividing that by 
number of packets received/transmitted.  This only shows data payload. 
It doesn't include the 40 bytes of IP and TCP header.

With this in mind, it is very possible to see the TCP Bits/Sec graph 
showing 0 or very close to 0 bits/sec *but* this graph (and the graph 
below) showing data.

This graph computes data as:

TCP Incoming Data Payload size = tcp_InDataBytes / tcp_InDataSegs
TCP Outgoing Data Payload size = tcp_OutDataBytes / tcp_OutDataSegs

TCP per Packet Header Overhead (%):
http://www.seanoneill.info/orca/o_gauge_tcp_InOvH_pct,o_gauge_tcp_OutOvH_pct-hourly.html

This graph takes the payloads computed above and figures out how much of 
the packet was "overhead".  So:

TCP In Overhead = 100 * 40 / ("TCP Incoming Data Payload size" + 40)
TCP Out Overhead = 100 * 40 / ("TCP Outgoing Data Payload size" + 40)

This may be useful for those cases where a server is servicing an 
application but you don't really know how but the data payload is and 
how much of those packets of overhead.  For instance, a chat service or 
  SSH service is generall going to have a small data payload with a lot 
of packet overhead.  An FTP service would generally be the opposite - 
max data payload and very small overhead.

Sean