netdev - SNMP OutOctets counter semantics

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sun, 18 Apr 2010 14:16:17 +0200
From:	Mattias Rönnblom <hofors@...ator.liu.se>
To:	netdev@...r.kernel.org
Subject: SNMP OutOctets counter semantics

Hi,

after having a look at the SNMP counters (exposed in /proc/net/snmp
among other places), I have a question on the meaning of the
"OutOctets" counter. I'm looking at 2.6.33.

According to include/linux/snmp.h IPSTATS_MIB_OUTPKTS is
"OutRequests". The same file refers to
"draft-ietf-ipv6-rfc2011-update-10.txt", which I believe is what
became RFC 4293. According to both of those standard documents,
"OutRequest" counts IP packets coming from upper (sub-)layers (a
transport layer, ICMP etc) into the IP layer.

This corresponds well with how this counter is actually incremented in
the code, as far as I can tell.

In 2.6.31, a corresponding byte counter "OutOctets" was introduced,
which in the Linux kernel counted the same packets as "OutRequest",
but was a byte counter.

In RFC 4293 (and its draft) there is indeed a OutOctets, but this is a
byte counter for packets _leaving_ the IP layer into the link layer.
This counter in the standard corresponds to the "OutTransmits" packet
counter, which is not implemented in the Linux kernel.

My question is: is this simply a bug, or does the kernel draw its
counter semantics from some other standard?

Best regards,
     Mattias
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html