monitoring network traffic

[Igor Schein]

Hi,

what's the best way to monitor bandwidth usage by connection on HPUX? My favorite tool is iftop, but it's not easily portable to HPUX. iptraf would also be sufficient, but it's intrinsically Linux. ntop is a possibility, but it was very bloated last time I checked, and I don't know how easily it can be ported to HPUX.

Thanks

Igor

[Steven E. Protter]

glance/gpm has a 60 day trial and can monitor network usage well.

If you need to see the packets, consider ethereal or tcpdump.

Part of the sar package I'm uploading monitors network traffic as well.

SEP

[Igor Schein]

gpm/glance is a major bloatware, even more so than ntop. I don't need packet level, I just need to measure transfer rate per connection. iftop does *exactly* what I need, no more no less. I am amazed such a utility didn't exist from the beginning of unix era, it's so fundamental.

Thanks

Igor

[RAC_1]

#Script for chekcing lan i/p and o/p stats.
------------------------------------------------
let z=0

let y=$(lanadmin -g mibstats 0|grep -i oct|grep Inbound|awk '{print $4}')

let y2=$(lanadmin -g mibstats 0|grep -i oct|grep Outbound|awk '{print $4}')

while true

do

let x=0

sleep 1

x=$(lanadmin -g mibstats 0|grep -i oct|grep Inbound|awk '{print $4}')

x2=$(lanadmin -g mibstats 0|grep -i oct|grep Outbound|awk '{print $4}')

let t=$x-$y

let t2=$x2-$y2

let y=$x

let y2=$x2

let z=$z+1

let t=$t/1000

let t2=$t2/1000

echo "${t} Kb/s inbound, ${t2} Kb/s outbound"

done

[TwoProc]

Did you search the HPUX Porting Archive?
http://hpux.cs.utah.edu/
Look in the catalog for networking tools - I saw several there that could possibly suit your needs.

[rick jones]

if all else fails, parsing the advacing sequence numbers in the output of ndd /dev/tcp tcp_status could tell you for tcp at least.

that there is no such tool in the base HP-UX os would seem to suggest it is not yet considered fundamental in the HP-UX space. however, if folks want that functionality, by all means excercise the support contact(s) and submit enhancement requests - that is the best way to make the desires known.

[Ron Kinner]

Try MRTG. Runs on just about anything and makes pretty graphs to show your traffic in and out. Price is right. Free.

http://people.ee.ethz.ch/~oetiker/webtools/mrtg/

Ron

[Igor Schein]

1) the script only does cumulative stats. If I have 2 scp's running at the same time, 1 at 10KB/s and 1 at 160KB/s, I'll only see 170KB/s.
2) It's a good idea to call HP support and submit an RFE. It'll be a great community service if they do come up with something, say, in 2 years from now, and I'll do that anyway, but I don't expect anything for me short term
3) I've been using HPUX depot archive for 10 years now. I know for a fact there's no software there which would suit my needs, but if I missed something, I'd greatly appreciate the actual program name
4) I know MRTG is good for graphing collected data, but will it give me real time stats like iftop does?

Thanks for all your answers.

Igor

[rick jones]

the tcp_status output will be cumulative for each connection, but if a script were to recall the last value and subtracts it from the current value it will give a current value.

IIRC MRTG graphs MIB stats. I'm not sure if there is a per-connection throughput MIB.

[Jacek Pliszka_2]

I need something similar too.

I am looking ofr a tool that will tell one of two (or both) things:

1. number of bytes transferred on current connection from given IP:port to server port.

2. time when given connection started - more precisely I have several servers and client makes connections to all of them and I want to find out which connection was the first one

Is there any solution for that ?

[rick jones]

IIRC the stack does not store the time a connection is established, so the best one could do is going to be bound by the granularity of how often one checks something like netstat or ndd tcp_status.

One _might_ make inferences as to which connection was first based on the client port number - if the client leaves port number selection to the transport then _generally_ the connection with the lower port number was established before the connection with the higher port number. Of course, if connectoin establishment and teardown is particularly chaotic this may not always work, but is no worse than guessing when one notices two or more connections for the first time.

The more "iron-clad" way to go about something like this would be to create a Streams module that sat above all the drivers, watching traffic and storing away stats. It would though have some non-trivial overhead.

I've no idea if it does it, but ipfilter is such a module for HP-UX - in that it can be pushed on top of all the interfaces on a system.

Is the desire to see per-connection stats for a specific reason, or is is a matter of academic interest?