Traffic shaper

[Jose M. del Rio]

Hi,
I'm looking for some kind of (freeware) software traffic shaper, i.e., a program that I can run in an HP-UX host to monitor traffic going in&out of a given NIC for a certain period and then print some usage statistics per TCP port. For example:

port Kb_transferred Kb/s_max Kb/s_avg
23 1.000 200 100
1521 5.000 300 200

Do you know any?
Thanks.
Regards.

[Steven E. Protter]

Shalom,

I know of no product specifically designed for HP-UX to do traffic shaping.

iostat may be able to help achieve this goal.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=51050

That thread links to two other threads with lots of good sysadmin scripts. It is worth the time to see whats in those 300 posts and see if something meets your needs.

I've been trying to do this under Linux. Some of the open source products may compile under HP-UX. However my results thus far were awful.

SEP

[Jose M. del Rio]

Hi SEP,
thanks for your answer.
I guess you meant netstat instead of iostat.
I've had a look at netstat but its statistics granularity is the protocol (tcp, udp...) not the port.
I've also browsed through the 3 pages of scripts but found nothing useful.
The most related is about using nettl but I could also do it with tcpdump.
The problem with these tools is the huge capture file they produce and I'm not really interested in capturing the packets but only in the statistics.
Regards.

[Steven E. Protter]

Shalom,

netstat -i might be useful but it will not break it down by process.

I really meant iostat because you question used the term.

SEP

[Duncan Edmonstone]

Jose,

Does MRTG:

http://hpux.connect.org.uk/hppd/hpux/Networking/Admin/mrtg-2.15.2/

or Wireshark:

http://hpux.connect.org.uk/hppd/hpux/Gtk/Applications/wireshark-0.99.6/

Fit the bill at all?

HTH

Duncan

[skt_skt]

extract is the other tool i can recommend. But i never used this for port statistcis.. have a look..

[Jose M. del Rio]

Hi, Duncan:
With respect to MRTG, I daresay it wont' be useful because, given an IP, it just retrieves the SNMP OID's related to in&out bytes of a NIC (ifInOctets = 1.3.6.1.2.1.2.2.1.10, ifOutOctets = ...). These are the same statistics we can retrieve directly with an SNMP client or with lanadmin -g mibstats, i.e., it won't give us a per-port breakdown.
And concerning Wireshark, I regularly use libpcap + tcpdump on the HP-UX boxes and Winpcap + Wireshark on the Windows ones. They are both (good) sniffers that will capture all the traffic and afterwards show you the statistics I'm looking for. But in my case this wpuld mean recording all the packets in a capture file during a whole day, something hardly affordable.
Thanks anyway for your answer.


Santhosh:
I wonder if you refer to the 'extract' command of OVPA (Measureware).
As far as I'm aware, it will give us only aggregate data per NIC (again: not per TCP port).
* BYNETIF_IN_BYTE_RATE
* BYNETIF_OUT_BYTE_RATE
...

Regards.

[Jose M. del Rio]

Hi,
after some fruitless research, I gave up finding a commercial solution and I ended up developing a custom application by pasting snippets from this libpcap tutorial:
http://www.e-ghost.deusto.es/docs/2005/conferencias/pcap.pdf
and from tcpdump's source code:
http://hpux.cs.utah.edu/hppd/cgi-bin/search?package=on&description=on&term=tcpdump
It works fine but, should anyone find a commercial solution, I'd be willing to know it.
Thanks.
Regards.

[rick jones]

Just to pick a nit - what you are doing is reporting, not shaping. Shaping would be forcing the flows into specified limits.

WRT to actually shaping traffic, perhaps ipfilter can do some of that sort of thing now. Otherwise, it is a crude and blunt intstrument, but there is a port of the BSD "dummynet" to a Streams module at:

ftp://ftp.cup.hp.com/dist/networking/tools/

which of course would be unsupported, may not work with the latest release of HP-UX, use at your own risk etc etc etc...

[Jose M. del Rio]

Hi Rick,
with respect to shaping vs. reporting, you are absolutely right.
Maybe my confusion came from the fact that traffic shapers, besides actually shaping the traffic, report what its current distribution is.
I had been having a look at dummynet but I think its purpose is simulating traffic bottlenecks, bandwidth shortages, etc.
Thanks.
Regards.

[rick jones]

I mention dummynet for the "shaping" only because I know it is there :) and that i generally associate shaping with "limit the bandwidth" :) :)

There are some _ancient_ (internet time) examples of dummynet being used in some of the FTP server writeups at:

ftp://ftp.cup.hp.com/dist/networking/briefs/

[Jose M. del Rio]

Interesting works at
ftp://ftp.cup.hp.com/dist/networking/briefs/
I've especially liked this one:
ftp://ftp.cup.hp.com/dist/networking/briefs/sane_glance.txt
Thanks for your info.

[rick jones]

I believe that Glance has gotten rather more sane on its own since that writeup :)