netdev - Re: Why are network counters only updated once a second?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 14 Jan 2008 21:45:33 +0100
From:	Eric Dumazet <dada1@...mosbay.com>
To:	Mark Seger <Mark.Seger@...com>
CC:	netdev <netdev@...r.kernel.org>
Subject: Re: Why are network counters only updated once a second?

Mark Seger a écrit :
> I had mentioned this in my previous post but perhaps it might get more 
> attention all by itself.  I can't say for sure when this changed, but 
> for the longest time network counters were only updated once every 
> 0.9765 seconds and unless you used a tools like collectl that could 
> monitor at fractional intervals, your traffic was under-reported AND 
> you'd get periodic spikes of double the actual rate.  See 
> http://collectl.sourceforge.net/NetworkStats.html for a more complete 
> explanation.
> 
> Eventually the frequency became better aligned at a 1 second interval 
> because now the number look better, but the problem I see is that when 
> the sampling interval is very close to the monitoring interval you still 
> get periodic incorrect data.  Furthermore, you now need to know which 
> way the counters are updated before you pick a sampling interval!  But 
> the real point is if anyone ever wants to do finer grained monitoring, 
> say every 1/2 or even tenth of a second, they can't because the counters 
> won't change between samples.  Has this ever been discussed before?
> 

Yes it was discussed before. Some devices perform counters updates directly at 
the NIC level, and one in a while a transfert of counters is done to the host.

This is supposed to be better, especially on SMP.

Maybe you need to setup accounting rules with iptables, so that you can 
perform counter sampling at whatever rate you want ?

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html