TCP activity / statistics detection

Question

I would like to find the TCP payload activity counter (total number of bytes) for either a given file descriptor or for a given interface. Preferably, this file descriptor, but for the interface would be sufficient. Ideally, I would really like to know about any bytes that were found, even those that I have not read in user space yet (yet?).

I saw the TCP_INFO getsockopt() function, but none of the fields store "Total bytes received" or "Total transmitted bytes (for example)", as far as I can tell.

I also saw the netlink fields IFLA_STATS + RTNL_TC_BYTES and SIOCETHTOOL + ETHTOOL_GSTATS ioctl() ( rx_bytes ) for interfaces, and they are great, but I don’t know that they can distinguish between service / headers of other levels and actual payload bytes.

procfs has /proc/net/tcp , but that doesn't seem to contain what I'm looking for.

Is there any way to get this data?

EDIT: Messy mode has an unbearable effect on throughput, so I can't use everything that uses it. Not to mention the fact that introducing large parts of the IP stack to determine which packets are suitable goes beyond my intended use for this solution.

The goal is to have a comprehensive / no-trust / second guess about what values ​​are stored in recvmsg ().

The Right Thing ™ is keeping track of these values ​​correctly, but it would be helpful to have a simple “Hey OS”. How many bytes did I really get on this socket? "

Answer 1

You can also use the ioctl call with SIOCINQ to get the amount of unread data in the queue in the receive buffer. Here is the use from the man page: http://man7.org/linux/man-pages/man7/tcp.7.html

 int value; error = ioctl(tcp_socket_fd, SIOCINQ, &value); 

For TCP interface statistics, we can use "netstat -i -p tcp" to search statistics for each interface.

Answer 2

Do you want this for diagnostics or for development?

If diagnosed, tcpdump can tell you exactly what is happening on the network, filtered out by the port and host information.

If for development, perhaps a little more information about what you are trying to achieve will help ...

ifconfig gives the resulting RX and TX values.

ifconfig gets this data from / proc / net / dev (as you can see through ifcconfig strace).

There are also Send / Receive-Q values ​​set by netstat -t if this is closer to what you want.

Answer 3

Perhaps the statistics in / proc / net / dev may help. I am not familiar with payload calculation compared to full packets, including headers, which makes the answer difficult.

Regarding the statistics of individual file descriptors, I do not know of any standard means for obtaining this information.

If it is possible to control the launch of programs that require statistics, you can use the interceptor library, which implements its own calls to read (), write (), sendto () and recvfrom (), passing through calls to the standard C library (or directly to system call), save activity counters and find a way to publish these values.

Answer 4

If you don’t want to just calculate the total RX / TX for the interface (which is already available in the ifconfig / iproute2 tools) ...

If you look at / proc a little more, you can get some more information. More specifically /proc/<pid>/net/dev .

Output Example:

  Inter-| Receive | Transmit face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed eth0: 12106810846 8527175 0 15842 0 0 0 682866 198923814 1503063 0 0 0 0 0 0 lo: 270255057 3992930 0 0 0 0 0 0 270255057 3992930 0 0 0 0 0 0 sit0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 

If you start looking, the information comes from net/core/net-procfs.c from the Linux kernel (procfs just uses this information). Of course, all this means that you need a specific process to track.

You can either view the information available in /proc , or if you need something more stable, it might make sense to duplicate net-procfs functions specifically for your application.