dtrace discuss - Jan 2006 - Total number of open socket connections using Dtrace.

Hi,

Is there a way to write a Dscript to know the total number of open 
socket connections, and not only since when Dscript is running?

Thanks,
Ashu.

-- 
Nothing is impossible, except ''impossible'' itself.
                                             -ashu

On Mon, 2 Jan 2006, Ashutosh Kumar wrote:
> Hi,
>
> Is there a way to write a Dscript to know the total number of open socket 
> connections, and not only since when Dscript is running?
Hi Ashu,

It you are just looking for connection statistics and not the parties 
involved, you might have a look at the output from ''netstat
-s''.

- Ryan
--
UNIX Administrator
http://daemons.net/~matty

Hi Matty,

Though we can get total number of socket connections by ''netstat
-a'',
however I am wondering is there a way to do the same using Dtrace? So, I 
am interested specifically in Dtrace ;-)

Thanks,
Ashu.

Matty wrote:
>
> On Mon, 2 Jan 2006, Ashutosh Kumar wrote:
>
>> Hi,
>>
>> Is there a way to write a Dscript to know the total number of open 
>> socket connections, and not only since when Dscript is running?
>
>
> Hi Ashu,
>
> It you are just looking for connection statistics and not the parties 
> involved, you might have a look at the output from ''netstat
-s''.
>
> - Ryan
> -- 
> UNIX Administrator
> http://daemons.net/~matty
> _______________________________________________
> dtrace-discuss mailing list
> dtrace-discuss at opensolaris.org

-- 
Nothing is impossible, except ''impossible'' itself.
                                             -ashu

On Tue, 3 Jan 2006, Ashutosh Kumar wrote:
> Hi Matty,
>
> Though we can get total number of socket connections by ''netstat
-a'', however
> I am wondering is there a way to do the same using Dtrace? So, I am 
> interested specifically in Dtrace ;-)
Hi Ashu,

You can use the mib provider to watch various values, but this would be 
for the life of the DTrace session. I am not aware of a way to grab 
historical data through DTrace (other than using system() and calling 
netstat). Why can''t you use netstat?

- Ryan
--
UNIX Administrator
http://daemons.net/~matty

Hi Matty,

I can use netstat, however I was just exploring is there a way to know 
the historical data using Dtrace because as per my understanding Dtrace 
is event based; changes in events can be traced but not the historical 
data.

Also I wanted output in following manner at a regular interval of 
sampling rate say 5 sec:

Sample                Total no. of open socket connections               
         Newly opened socket connection
--------               -------------------------------------            
              ----------------------------------
.........
........

Thanks,
Ashu.

Matty wrote:
> On Tue, 3 Jan 2006, Ashutosh Kumar wrote:
>
>> Hi Matty,
>>
>> Though we can get total number of socket connections by
''netstat -a'',
>> however I am wondering is there a way to do the same using Dtrace? 
>> So, I am interested specifically in Dtrace ;-)
>
>
> Hi Ashu,
>
> You can use the mib provider to watch various values, but this would 
> be for the life of the DTrace session. I am not aware of a way to grab 
> historical data through DTrace (other than using system() and calling 
> netstat). Why can''t you use netstat?
>
> - Ryan
> -- 
> UNIX Administrator
> http://daemons.net/~matty
> _______________________________________________
> dtrace-discuss mailing list
> dtrace-discuss at opensolaris.org

-- 
Nothing is impossible, except ''impossible'' itself.
                                             -ashu

Hi Ashu,
> I can use netstat, however I was just exploring is there a 
> way to know 
> the historical data using Dtrace because as per my 
> understanding Dtrace 
> is event based; changes in events can be traced but not the 
> historical 
> data.
Yep, that understanding is correct.

What usually helps you out in this sort of case is that the backquote (`)
operator gives you access to variables in the kernel namespace - which means you
can periodically dump out members of the TCP MIB. I think the tcpCurrEstab
statistic gives roughly what you''re after, so a one-liner like:

dtrace -n ''tick-1sec{printf("%d\n",
`tcp_mib.tcpCurrEstab)}''

will print out this stat every second. Then it''s trivial to store the
old value and work out the delta.

This is the general approach. Unfortunately the fly in the ointment here is that
this particular statistic isn''t maintained as a counter - from a browse
of the source, it looks like it''s computed on the fly, as required,
when tcp_snmp_get is called. As such, the value printed by the above dtrace
command won''t always be up-to-date (you should see that you can force
it to be updated by running netstat -s).

What you might be able to do, in combination with a knowledge of the source, is
use a combination of the other true counters in the MIB to get the info you
require; tcpActiveOpens + tcpPassiveOpens - (some count of closed connections)
looks like what you''re after, although I can''t immediately see
a good way to get the count of closed connections. Someone with better knowledge
of the code might be able to finish this off, though.

-- 

Philip Beevers
Fidessa Infrastructure Development

mailto:philip.beevers at fidessa.com
phone: +44 1483 206571




******************************************************************    
This message is intended only for the stated addressee(s) and
may be confidential.  Access to this email by anyone else is
unauthorised. Any opinions expressed in this email do not
necessarily reflect the opinions of royalblue. Any unauthorised
disclosure, use or dissemination, either whole or in part is
prohibited. If you are not the intended recipient of this message,
please notify the sender immediately.
******************************************************************

Alternatively,

# kstat tcp:0:tcp:currEstab 1


will print the current number of TCP connections in established state every
second

	Kais

Philip Beevers wrote On 01/03/06 06:09,:
> Hi Ashu,
> 
> 
>>I can use netstat, however I was just exploring is there a 
>>way to know 
>>the historical data using Dtrace because as per my 
>>understanding Dtrace 
>>is event based; changes in events can be traced but not the 
>>historical 
>>data.
> 
> 
> Yep, that understanding is correct.
> 
> What usually helps you out in this sort of case is that the backquote (`)
operator gives you access to variables in the kernel namespace - which means you
can periodically dump out members of the TCP MIB. I think the tcpCurrEstab
statistic gives roughly what you''re after, so a one-liner like:
> 
> dtrace -n ''tick-1sec{printf("%d\n",
`tcp_mib.tcpCurrEstab)}''
> 
> will print out this stat every second. Then it''s trivial to store
the old value and work out the delta.
> 
> This is the general approach. Unfortunately the fly in the ointment here is
that this particular statistic isn''t maintained as a counter - from a
browse of the source, it looks like it''s computed on the fly, as
required, when tcp_snmp_get is called. As such, the value printed by the above
dtrace command won''t always be up-to-date (you should see that you can
force it to be updated by running netstat -s).
> 
> What you might be able to do, in combination with a knowledge of the
source, is use a combination of the other true counters in the MIB to get the
info you require; tcpActiveOpens + tcpPassiveOpens - (some count of closed
connections) looks like what you''re after, although I can''t
immediately see a good way to get the count of closed connections. Someone with
better knowledge of the code might be able to finish this off, though.
>