Hello every one.

I have this problem which makes me anxious recently.

I want to write a program to report about how many time a routing entry is used (or more clearly, how many packets have been sent through a route in a fixed period)

I think I may have to put some kind of trigger somewhere, but I don't know exactly how.

Anyone has any idea how to do it?


Thanks a lot.

Thanh/

there are two counts associated with any route, reference count and usage count,
everytime the packet uses a route, the usage count is incremented.
reference count is just to see how many connections (or transactions) are using that route. Usage count can be seen using the route -nC command, this is to see the route cache...

--iptraf is a utility that shows how many packets and bytes have left that interface,


HTH

Thank you very much for your info Shishir

However, do you know the API to get those information (reference count and usage count), and is it possible to know whenever a packet is sent through an interface?

Thanks in advance

i am not sure if there is any direct api that can give you this statistic...because netstat causes a read on the proc filesystem that contains these statistics...

you can write your own system call that can parse the whole of route cache and print the counts (these are in a structure called rtable, defined in net/route.h)..

it is not very difficult, infact, you can use a lot of kernel code to see how to write a call that can take the src and destination ips and give their statistics , by looking in the hash table (route cache)..

CORRECTION : the structure is that contains refcnt and use is not rtable but one it usesdst_entry (in net/dst.h). I apologise for the error.

THank you very much indeed.

you can use netlink to get informatin about routes, i think that includes usage count. look on my site about 1/2 way down for a bunch of examle code, and the file /usr/include/linux/rtnetlink.h

yeah, you can use the routing sockets for this purposes...damn, how could i forget that...., this function uses a structure rta_cacheinfo, that is filled in by the kernel using a function called inet_rtm_getroute(), which in turn uses the function rt_fill_info() to get the job done, the fields in the
structure rta_cacheinfo
{
__u32 rta_clntref;
__u32 rta_used;
}
would be the ones you are interested in...

THanks very much shishir and infamous41md

To infamous41md: I found the paragraph you wrote about netlink