topic Re: networking tool like ntop in Operating System - HP-UX

networking tool like ntop

Andrea_66 — Fri, 04 Jun 2004 10:05:03 GMT

Hello Guys,
does anyone knows if there is tool that checks in real time network connections bandwidth (KB/S)?
ex.
172.30.223.150:4338->172.30.223.152:1526| 3KBs
I tried Ntop but I wasn't able to install it in HP-UX 11.11 -
Any help would be appreciated.
Thank you, bye,
Andrew

Re: networking tool like ntop

Sridhar Bhaskarla — Fri, 04 Jun 2004 10:08:55 GMT

Hi Andrew,

Look at Netperf.

http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/netperf-1.7.1/

-Sri

Re: networking tool like ntop

Jose Mosquera — Fri, 04 Jun 2004 10:13:45 GMT

Hi,

Check this official Download HP porting site, pls refer at "Networking/Admin" section:

http://hpux.connect.org.uk/hppd/hpux/alpha.html

Rgds.

Re: networking tool like ntop

Sanjay_6 — Fri, 04 Jun 2004 10:54:30 GMT

Hi Andrew,

Try this,

http://hpux.connect.org.uk/hppd/hpux/Networking/Admin/sntop-1.4.2/

you may have to recompile the source code for 11i if the 11.0 version does not work.

Hope this helps.

Regds

Re: networking tool like ntop

Victor BERRIDGE — Fri, 04 Jun 2004 11:02:19 GMT

And there is also ttcp wich is a lightweight program freely available...
I got a copy from http://ftp.arl.mil/ftp/pub/ttcp

All the best

Victor

Re: networking tool like ntop

Andrea_66 — Mon, 07 Jun 2004 05:26:45 GMT

Thank you for the replies, I'll try those solutions and reply!
I've already tried Netperf and it doesn't seem to be compliant with what i'm looking for, anyway i'll try it again.
Stay in tune, please
Bye

Re: networking tool like ntop

Andrea_66 — Mon, 07 Jun 2004 11:11:56 GMT

Some news:
I tried Netperf and Ttcp, but they require an additional installation on the remote machine I want to monitor. Unfortunately I can't perform this installation, because I don't have access on that machine.
For Sntop, instead, i didn't find the information i need (the bandwidth in KB/S), maybe because i can't use it! Any suggestion??
Thanks
Goodbye

Re: networking tool like ntop

Victor BERRIDGE — Mon, 07 Jun 2004 12:00:08 GMT

Hi again,
I just tested ttcp, there is depending what you want no need to have it on the remote box:
on draco (remote box)=>
# find / -name ttcp -print
/usr/dt/bin/ttcp #This is NOT the program...

# ./ttcp -t -p9 -n100000 -s draco
ttcp-t: nbuf=100000, buflen=1024, port=9
ttcp-t: socket
ttcp-t: connect
ttcp-t: 0.1user 0.9sys 0:09real 11% 0i+59d 29maxrss 0+0pf 3760+103csw
ttcp-t: 102400000 bytes in 1.040000 CPU seconds = 96153.846154 KB/cpu sec
ttcp-t: 102400000 bytes in 9.094533 real seconds = 10995.616817 KB/sec
octant # pwd
/sm/export/hpux/admin

You need to compile it thought...

All the best
Victor

Re: networking tool like ntop

Sridhar Bhaskarla — Mon, 07 Jun 2004 12:26:35 GMT

Hi Andrew,

This may be too much for what you are trying to do.

The product ethereal has the capability to show the bandwidth for that moment. It cannot be used to continuously capture the data. It can be painful to install this tool. It's available at the same site.

If you need to continuously capture the data, then you will need to use measureware. You can capture the IN_BYTE and OUT_BYTE metrics per interface and arrive at the bandwidth usage. Even with SNMP (snmpget) you can capture the data.

-Sri

Re: networking tool like ntop

rick jones — Mon, 07 Jun 2004 12:54:43 GMT

As much as I like to promote netperf :) indeed it is not suited as a monitoring tool. Netperf is a benchmark, not a monitor. Ttcp is similar.

Glance has some network statistics in it, although they are not per-connection.

IIRC, the only way to get per-connection statistics is to use packet tracing. Perhaps that is what ntop does. If so, the overhead may be rather substatial

Re: networking tool like ntop

Tim D Fulford — Mon, 07 Jun 2004 14:07:17 GMT

MeasureWare (or OV PerformanceAgent) and or GlancePlus

If you go to the networking interface you can see throughput (pkt/s) and bandwidth (kB/s)

alternativey use the attached to get the hacked version of some cleaver perl that a kind sole donated to me...

Tim

Re: networking tool like ntop

Andrea_66 — Tue, 08 Jun 2004 08:37:16 GMT

Even if some of your suggestions are valid I still haven't found what I'm looking for:

- Ttcp is a good and easy program but there is a firewall, between the machines i want to monitor, that blocks the packets sent by Ttcp when it tests the two connections.
That's the reason why I should use a program like Ethereal that performs nothing but a packet capture, but I tried it and, as Sridhar Bhaskarla says, it can't be used to continuously capture the data.

- Nor Glance neither the script Tim Fulford sent me are able to perform a per-connection statistic.

Anyway thank you all, if you have any further suggestion post it!!

Bye,

Andrew

Re: networking tool like ntop

rick jones — Tue, 08 Jun 2004 12:26:04 GMT

Again, ttcp and netperf are not monitors, they are active traffic sources. They can tell you nothing about other existing connections.

The only way to get per-connection numbers is to sniff the traffic a la ethereal/tcpdump/nettl. Or, have a module sitting on top of the driver, or just below the stream-head, that is tracking all that. (NSSMOP - Not So Small Matter of Programming)

If we back-up a bit - to what end do you want to see per-connection traffic statistics?

Re: networking tool like ntop

Andrea_66 — Wed, 09 Jun 2004 02:54:21 GMT

The problem is that programs like ethereal, even if they capture packets for a large amount of time, give you an average result of the transfer rate/packet rate on a specified connection. That's good, but I would like to check this rates in real time, to observe the bandwidth peaks and none of the program I seen is able to do that.

Re: networking tool like ntop

rick jones — Wed, 09 Jun 2004 12:29:13 GMT

But what is it that makes you want to look at the individual connections in real time. That is to say, what problem, or perceived problem, are you trying to diagnose? Or are you simply curious?

Perhaps there are third-party tools out there (or maybe even HP ones - you might peruse software.hp.com) that can do what you want - however, likely as not, they will be implemented by putting the interface(s) into promiscuous mode, and that is not condusive to maintaining performance.

Now, thinking about things just a triffle more...and remembering something that is already there.

There is an ndd command:

ndd -get /dev/tcp tcp_status that will provide, per-connection, data for the next sequence number TCP expects to send (snxt), the last sequence number the remote has not yet ACKed (suna), the next sequence number it expects to receive (rnxt), and the last sequence number it has ACKed (rack). It also emits a few other fields that could be used to

In theory, one could write a small script that parsed the output of ndd -get /dev/tcp tcp_status over intervals, did a bit of math, and then showed how much data has been sent/received on that TCP connection over the interval. It would need to deal with connections coming and going during the interval, and of course, if the connection were sufficiently short-lived it would be missed, and it only covers TCP, but it might get you where you want to be.

Sequence numbers "identify" bytes - so if the sequence number has advanced by 128, that means 128 bytes have gone through.

So, I suppose for TCP, for reasonably stable connections (not coming and going quickly) there is a reasonably straightforward and not too heavyweight way to get per-connection bandwidth statistics.

Re: networking tool like ntop

Andrea_66 — Fri, 11 Jun 2004 08:25:47 GMT

Ok, I'll tell you exactly what is my issue:
There is an Oracle DB link between the server I manage (location: Italy) and a remote Server (location: Germany), with about 10, 20 firewalls between them.
Now, since some days it seems that the two systems are exchanging their data very slowly, for this reason I need to monitor the two IP's bandwidth on the DB spefic port (in this case 1526).
I'd like to use something a little bit more "user-friendly" than your solution, but if it's the only way i'll try to do what you have just said.
Anyway Thank you,
Bye

Re: networking tool like ntop

D Block 2 — Fri, 11 Jun 2004 13:07:43 GMT

Andrew,

I just talked with a network expert (and I also know Rick Jones is the network king here)..

my network expert told me to use Ethereal/TCPDUMP on each end.

good luck,
Tom

Re: networking tool like ntop

Geoff Wild — Fri, 11 Jun 2004 13:35:27 GMT

Tim - I get the following error when testing your script:

Use of uninitialized value in sprintf at /usr/local/bin/netstats line 19.

Rgds...Geoff

Re: networking tool like ntop

rick jones — Fri, 11 Jun 2004 15:23:16 GMT

10 or 20 _firewalls_!?! or 10 or 20 routers?(rather different thing)

if the folks administering those things haven't gone completely paranoid, you might compare ping times between those times when performance is good, and then when it is bad.

Also, if there are lots of packet losses on that path, the tcp_status output column for "rto" (retransmission timeout) will likely be fairly large - especially compared to the RTT (ping times).

Re: networking tool like ntop

Tim D Fulford — Fri, 11 Jun 2004 17:02:11 GMT

Geff

ooops. The way you are ment to use the prog is
kbit+PktRate.pl
e.g.
kbit_PktRate.pl 0
would do lan0 (or whatever lanadmin ppa 0 will do)

If you add
my $if=shift;
if ( ! $if ) {
$if=0;
}
error will disapear if you miss interface number...

If you want to change the monitoring time memely change the value of $sl (sleep) so $sl=60 is a 1 minute sleep.

Tim

Tim