networking tool like ntop

[Andrea_66]

Hello Guys,
does anyone knows if there is tool that checks in real time network connections bandwidth (KB/S)?
ex.
172.30.223.150:4338->172.30.223.152:1526| 3KBs
I tried Ntop but I wasn't able to install it in HP-UX 11.11 -
Any help would be appreciated.
Thank you, bye,
Andrew

[Sridhar Bhaskarla]

Hi Andrew,

Look at Netperf.

http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/netperf-1.7.1/

-Sri

[Jose Mosquera]

Hi,

Check this official Download HP porting site, pls refer at "Networking/Admin" section:

http://hpux.connect.org.uk/hppd/hpux/alpha.html

Rgds.

[Sanjay_6]

Hi Andrew,

Try this,

http://hpux.connect.org.uk/hppd/hpux/Networking/Admin/sntop-1.4.2/

you may have to recompile the source code for 11i if the 11.0 version does not work.

Hope this helps.

Regds

[Victor BERRIDGE]

And there is also ttcp wich is a lightweight program freely available...
I got a copy from http://ftp.arl.mil/ftp/pub/ttcp

All the best

Victor

[Andrea_66]

Thank you for the replies, I'll try those solutions and reply!
I've already tried Netperf and it doesn't seem to be compliant with what i'm looking for, anyway i'll try it again.
Stay in tune, please
Bye

[Andrea_66]

Some news:
I tried Netperf and Ttcp, but they require an additional installation on the remote machine I want to monitor. Unfortunately I can't perform this installation, because I don't have access on that machine.
For Sntop, instead, i didn't find the information i need (the bandwidth in KB/S), maybe because i can't use it! Any suggestion??
Thanks
Goodbye

[Victor BERRIDGE]

Hi again,
I just tested ttcp, there is depending what you want no need to have it on the remote box:
on draco (remote box)=>
# find / -name ttcp -print
/usr/dt/bin/ttcp #This is NOT the program...

# ./ttcp -t -p9 -n100000 -s draco
ttcp-t: nbuf=100000, buflen=1024, port=9
ttcp-t: socket
ttcp-t: connect
ttcp-t: 0.1user 0.9sys 0:09real 11% 0i+59d 29maxrss 0+0pf 3760+103csw
ttcp-t: 102400000 bytes in 1.040000 CPU seconds = 96153.846154 KB/cpu sec
ttcp-t: 102400000 bytes in 9.094533 real seconds = 10995.616817 KB/sec
octant # pwd
/sm/export/hpux/admin

You need to compile it thought...

All the best
Victor

[Sridhar Bhaskarla]

Hi Andrew,

This may be too much for what you are trying to do.

The product ethereal has the capability to show the bandwidth for that moment. It cannot be used to continuously capture the data. It can be painful to install this tool. It's available at the same site.

If you need to continuously capture the data, then you will need to use measureware. You can capture the IN_BYTE and OUT_BYTE metrics per interface and arrive at the bandwidth usage. Even with SNMP (snmpget) you can capture the data.

-Sri

[rick jones]

As much as I like to promote netperf :) indeed it is not suited as a monitoring tool. Netperf is a benchmark, not a monitor. Ttcp is similar.

Glance has some network statistics in it, although they are not per-connection.

IIRC, the only way to get per-connection statistics is to use packet tracing. Perhaps that is what ntop does. If so, the overhead may be rather substatial

[Tim D Fulford]

MeasureWare (or OV PerformanceAgent) and or GlancePlus

If you go to the networking interface you can see throughput (pkt/s) and bandwidth (kB/s)

alternativey use the attached to get the hacked version of some cleaver perl that a kind sole donated to me...

Tim

[Andrea_66]

Even if some of your suggestions are valid I still haven't found what I'm looking for:

- Ttcp is a good and easy program but there is a firewall, between the machines i want to monitor, that blocks the packets sent by Ttcp when it tests the two connections.
That's the reason why I should use a program like Ethereal that performs nothing but a packet capture, but I tried it and, as Sridhar Bhaskarla says, it can't be used to continuously capture the data.

- Nor Glance neither the script Tim Fulford sent me are able to perform a per-connection statistic.

Anyway thank you all, if you have any further suggestion post it!!

Bye,

Andrew

[rick jones]

Again, ttcp and netperf are not monitors, they are active traffic sources. They can tell you nothing about other existing connections.

The only way to get per-connection numbers is to sniff the traffic a la ethereal/tcpdump/nettl. Or, have a module sitting on top of the driver, or just below the stream-head, that is tracking all that. (NSSMOP - Not So Small Matter of Programming)

If we back-up a bit - to what end do you want to see per-connection traffic statistics?

[Andrea_66]

The problem is that programs like ethereal, even if they capture packets for a large amount of time, give you an average result of the transfer rate/packet rate on a specified connection. That's good, but I would like to check this rates in real time, to observe the bandwidth peaks and none of the program I seen is able to do that.

[rick jones]

But what is it that makes you want to look at the individual connections in real time. That is to say, what problem, or perceived problem, are you trying to diagnose? Or are you simply curious?

Perhaps there are third-party tools out there (or maybe even HP ones - you might peruse software.hp.com) that can do what you want - however, likely as not, they will be implemented by putting the interface(s) into promiscuous mode, and that is not condusive to maintaining performance.

Now, thinking about things just a triffle more...and remembering something that is already there.

There is an ndd command:

ndd -get /dev/tcp tcp_status that will provide, per-connection, data for the next sequence number TCP expects to send (snxt), the last sequence number the remote has not yet ACKed (suna), the next sequence number it expects to receive (rnxt), and the last sequence number it has ACKed (rack). It also emits a few other fields that could be used to

In theory, one could write a small script that parsed the output of ndd -get /dev/tcp tcp_status over intervals, did a bit of math, and then showed how much data has been sent/received on that TCP connection over the interval. It would need to deal with connections coming and going during the interval, and of course, if the connection were sufficiently short-lived it would be missed, and it only covers TCP, but it might get you where you want to be.

Sequence numbers "identify" bytes - so if the sequence number has advanced by 128, that means 128 bytes have gone through.

So, I suppose for TCP, for reasonably stable connections (not coming and going quickly) there is a reasonably straightforward and not too heavyweight way to get per-connection bandwidth statistics.

[Andrea_66]

Ok, I'll tell you exactly what is my issue:
There is an Oracle DB link between the server I manage (location: Italy) and a remote Server (location: Germany), with about 10, 20 firewalls between them.
Now, since some days it seems that the two systems are exchanging their data very slowly, for this reason I need to monitor the two IP's bandwidth on the DB spefic port (in this case 1526).
I'd like to use something a little bit more "user-friendly" than your solution, but if it's the only way i'll try to do what you have just said.
Anyway Thank you,
Bye

[D Block 2]

Andrew,

I just talked with a network expert (and I also know Rick Jones is the network king here)..

my network expert told me to use Ethereal/TCPDUMP on each end.

good luck,
Tom

[Geoff Wild]

Tim - I get the following error when testing your script:

Use of uninitialized value in sprintf at /usr/local/bin/netstats line 19.


Rgds...Geoff

[rick jones]

10 or 20 _firewalls_!?! or 10 or 20 routers?(rather different thing)

if the folks administering those things haven't gone completely paranoid, you might compare ping times between those times when performance is good, and then when it is bad.

Also, if there are lots of packet losses on that path, the tcp_status output column for "rto" (retransmission timeout) will likely be fairly large - especially compared to the RTT (ping times).

[Tim D Fulford]

Geff

ooops. The way you are ment to use the prog is
kbit+PktRate.pl
e.g.
kbit_PktRate.pl 0
would do lan0 (or whatever lanadmin ppa 0 will do)

If you add
my $if=shift;
if ( ! $if ) {
$if=0;
}
error will disapear if you miss interface number...

If you want to change the monitoring time memely change the value of $sl (sleep) so $sl=60 is a 1 minute sleep.

Tim

Tim

[Sridhar Bhaskarla]

Andrew,

Looking at the requirement, I believe you will need to run tcpdump continuously ofcourse with a filter to capture packets only to/from the remote system and use some tool like tcptrace to plot the summary.

tcpdump and tcptrace are available at the porting site http://hpux.cs.utah.edu/

You may have to struggle a bit to get tcpdump installed as there are quite a few dependencies.

-Sri

[rick jones]

It would be good to run tcpdump. As for lots of dependencies, I have had quite good results from simply downloading libpcap and tcpudmp from www.tcpdump.org and compiling them with HP's compiler. Put both into the same subdirectory, configure and make libpcap first, have a symlink fro "libpcap" to the specific pcap directory, then configure and make tcpdump.

Otherwise, there is a tcpdump binary included as part of the HP Internet Express bits one can get from software.hp.com.

Another thing for the OP to consider is looking at netstat statistics during those times when performance seems sluggish - in particular look for data packets retransmitted and retransmission timeouts. If there are none, something else is happening. If there are some, since the stats are global, it means the connection(s) of interest _may_ be experiencing packet losses, which would affect performance.