I'm not sure about the data I'm collecting by my Cacti (MRTG) server or by the output of a show interface command. The input or output rate in bits/sec includes meassurement with Ethernet header? It is usually not important as pakcet size is much greater. My question becomes important when packet size is of 29 bytes, due to a DDoS attack and want to know if the amount of Mbps of my SNMP grpahics are including or not the Ethernet header in the calculation. Example of the show interface: FastEthernet0/1 is up, line protocol is up   Hardware is Fast Ethernet, address is 0016.47e9.04df (bia 0016.47e9.04df)   Internet address is 10.0.0.47/24   MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,      reliability 255/255, txload 1/255, rxload 1/255   Encapsulation ARPA, loopback not set   Keepalive set (10 sec)   Full-duplex, 100Mb/s, 100BaseTX/FX   ARP type: ARPA, ARP Timeout 04:00:00   Last input 00:00:02, output 00:00:02, output hang never   Last clearing of "show interface" counters never   Input queue: 0/4096/0/6 (size/max/drops/flushes); Total output drops: 0   Queueing strategy: fifo   Output queue: 0/4096 (size/max)   5 minute input rate 1000 bits/sec, 4 packets/sec  --- Does it include 20 to 30bytes of Ethernet header per paecket in this average rate?   5 minute output rate 25000 bits/sec, 3 packets/sec --- Does it include 20 to 30bytes of Ethernet header per paecket in this average rate?      3556080 packets input, 225842679 bytes      Received 1483940 broadcasts, 0 runts, 0 giants, 0 throttles      0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored      0 watchdog      0 input packets with dribble condition detected      2257306 packets output, 1751375346 bytes, 0 underruns      0 output errors, 0 collisions, 3 interface resets      0 unknown protocol drops      0 babbles, 0 late collision, 0 deferred      0 lost carrier, 0 no carrier      0 output buffer failures, 0 output buffers swapped out ... View more