knowing the bitrate of a specific TCP stream

Hi NG,
I hope not to be OT.
Given a TCP stream from node A to node B (in terms of [SRCIP:SRCPORT -
DSTIPSTPORT], I'd like to know at a given time T the number of bytes
sent (since the link setup time, up to time T) by querying some fs or
kernel struct.
Is this possible? (if so how?)
Thanks

On Tuesday 15 December 2009 14:26 in comp.os.linux.networking, somebody
identifying as Riccardo Manfrin wrote...

> Hi NG,
> I hope not to be OT.
> Given a TCP stream from node A to node B (in terms of [SRCIP:SRCPORT -
> DSTIPSTPORT], I'd like to know at a given time T the number of bytes
> sent (since the link setup time, up to time T) by querying some fs or
> kernel struct.
> Is this possible? (if so how?)
> Thanks

I cannot tell you *how* exactly - as I've never had the need to
investigate this - but it is possible, yes. I distinctly remember from
a few years ago that the KDE System Guard for instance had the ability
to show you this graphically by querying its "network sensors", and as
such, there must be a hook into "/proc" somewhere to get that
information from.

--
*Aragorn*
(registered GNU/Linux user #223157)

On Tuesday 15 December 2009 14:51 in comp.os.linux.networking, somebody
identifying as Aragorn wrote...

> On Tuesday 15 December 2009 14:26 in comp.os.linux.networking,
> somebody identifying as Riccardo Manfrin wrote...
>
>> Hi NG,
>> I hope not to be OT.
>> Given a TCP stream from node A to node B (in terms of [SRCIP:SRCPORT
>> - DSTIPSTPORT], I'd like to know at a given time T the number of
>> bytes sent (since the link setup time, up to time T) by querying some
>> fs or kernel struct.
>> Is this possible? (if so how?)
>> Thanks
>
> I cannot tell you *how* exactly - as I've never had the need to
> investigate this - but it is possible, yes. I distinctly remember
> from a few years ago that the KDE System Guard for instance had the
> ability to show you this graphically by querying its "network
> sensors", and as such, there must be a hook into "/proc" somewhere to
> get that information from.

Addendum...: Check the output of...

/sbin/ifconfig

You need not be root in order to use this command for querying only.

--
*Aragorn*
(registered GNU/Linux user #223157)

Well if I peek on /proc/net/whatever (tcp, udp, unix)
I can get some information with the rxqueue/txqueue field information.
That is nevertheless not enough to determine rate in terms of "octets
over seconds" which is my goal.
I'm starting to track tcpick (http://tcpick.sourceforge.net/) code
(keeping an eye on the old good tcpdump boy).
I wonder if they do the same stuff and if I can replicate their
functionalities and adapt them to my needs without having 100% CPU usage..


Aragorn wrote:
> On Tuesday 15 December 2009 14:51 in comp.os.linux.networking, somebody
> identifying as Aragorn wrote...
>
>> On Tuesday 15 December 2009 14:26 in comp.os.linux.networking,
>> somebody identifying as Riccardo Manfrin wrote...
>>
>>> Hi NG,
>>> I hope not to be OT.
>>> Given a TCP stream from node A to node B (in terms of [SRCIP:SRCPORT
>>> - DSTIPSTPORT], I'd like to know at a given time T the number of
>>> bytes sent (since the link setup time, up to time T) by querying some
>>> fs or kernel struct.
>>> Is this possible? (if so how?)
>>> Thanks
>> I cannot tell you *how* exactly - as I've never had the need to
>> investigate this - but it is possible, yes. I distinctly remember
>> from a few years ago that the KDE System Guard for instance had the
>> ability to show you this graphically by querying its "network
>> sensors", and as such, there must be a hook into "/proc" somewhere to
>> get that information from.
>
> Addendum...: Check the output of...
>
> /sbin/ifconfig
>
> You need not be root in order to use this command for querying only.
>

Riccardo Manfrin a écrit :
> Well if I peek on /proc/net/whatever (tcp, udp, unix)
> I can get some information with the rxqueue/txqueue field information.
> That is nevertheless not enough to determine rate in terms of "octets
> over seconds" which is my goal.

Look at the tcp_probe module
http://www.linuxfoundation.org/colla...ng/tcp_testing

You get time and sequence number.
This may be sufficient for your need.

Regards

Riccardo Manfrin wrote:
> Hi NG,
> I hope not to be OT.
> Given a TCP stream from node A to node B (in terms of [SRCIP:SRCPORT -
> DSTIPSTPORT], I'd like to know at a given time T the number of bytes
> sent (since the link setup time, up to time T) by querying some fs or
> kernel struct.
> Is this possible? (if so how?)
> Thanks

You can setup accounting rules with iptables. I don't know how because
someone else here did it.

Riccardo Manfrin wrote:

> Hi NG,
> I hope not to be OT.
> Given a TCP stream from node A to node B (in terms of [SRCIP:SRCPORT -
> DSTIPSTPORT], I'd like to know at a given time T the number of bytes
> sent (since the link setup time, up to time T) by querying some fs or
> kernel struct.
> Is this possible? (if so how?)

You should define more precisely what you mean. What do you do with, for
example, lost or retransmitted segments?

And, what do you include in the calculation? TCP header + payload, or
payload only? (or do you want to include lower level headers as well?)

Each side of the connection may have a different idea of how many bytes have
been "sent". And, btw, what is "sent" here? The number of bytes the
application wrote to the socket, or the bytes that have actually been sent
on the wire, or yet something else?