netdev - Why are network counters only updated once a second?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 14 Jan 2008 15:30:26 -0500
From:	Mark Seger <Mark.Seger@...com>
To:	netdev <netdev@...r.kernel.org>
Subject: Why are network counters only updated once a second?

I had mentioned this in my previous post but perhaps it might get more 
attention all by itself.  I can't say for sure when this changed, but 
for the longest time network counters were only updated once every 
0.9765 seconds and unless you used a tools like collectl that could 
monitor at fractional intervals, your traffic was under-reported AND 
you'd get periodic spikes of double the actual rate.  See 
http://collectl.sourceforge.net/NetworkStats.html for a more complete 
explanation.

Eventually the frequency became better aligned at a 1 second interval 
because now the number look better, but the problem I see is that when 
the sampling interval is very close to the monitoring interval you still 
get periodic incorrect data.  Furthermore, you now need to know which 
way the counters are updated before you pick a sampling interval!  But 
the real point is if anyone ever wants to do finer grained monitoring, 
say every 1/2 or even tenth of a second, they can't because the counters 
won't change between samples.  Has this ever been discussed before?

-mark

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html