linux-kernel - monitoring bytes processed off network interface in user space

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sat, 18 Oct 2008 10:09:57 -0700 (PDT)
From:	marty <martyleisner@...oo.com>
To:	linux-kernel@...r.kernel.org
Subject: monitoring bytes processed off network interface in user space

I want to be able to see if user space is processing network traffic
(as opposed to raw rx/tx packets on the interface).  

Is there a way to track this?  (beyond modifying all the applications which
deal with the network).  I need to track traffic to/from userspace to a 
"specific" interface, not things like localhost.

Note, this is an embedded system talking  (at times) appletalk,novell, ipv4, ipv6 and maybe other things...

Currently we have something like

while(1) {
     WOL packet
     timeout on no activity on rx/tx counts and then go sleep
}

Unfortunatley, rx/tx activity won't solve the problem on a busy lan with lots of broadcast packets.   If our WOL filter will only wake us on (lets say) on directed TCP/UDP packets, a constant ping will prevent us from going back to sleep...

If there isn't a way to do this, it may be simple to add some counters
in the right places in the network stacks (instead of packets, it would be bytes).

marty

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/