Hi,
I'm implementing an SNMP agent on Linux and want to get the following IF-MIB counters for Ethernet interfaces from the network device drivers: ifInUcastPkts, ifInMulticastPkts, ifInBroadcastPkts, ifOutUcastPkts, ifOutMulticastPkts, ifOutBroadcastPkts. I've looked at the /proc/net/dev info and it looks like it provides total packets, but does not break them down between unicast, multicast and broadcast. Is there any way to find this information (without rewriting the drivers)?
[on soapbox] It seems strange to me that some of these counters have been part of the original MIB-II (RFC 1213) Internet Standard since before 1991, and yet Unix doesn't seem to support them. Is the Linux community not aware of the IAB/IETF? [off soapbox]
Ken

On www.net-snmp.org , I see some tutorials said how to implement SNMP agent ( and agentx ) on Linux / Unix . If I'm not mistaken , this site introduces IF-MIB too .

By the way , I wonder that do you code your agent(x) from scratch ? It means that do you have to create your MIB-tree instead of using existing IF-MIB ?

We have a commercial SNMP agent that works just fine. The SNMP part is not the issue. Getting the correct values out of Linux is what I'm asking for help with.
Ken

This may be no different from what you get now, but does 'netstat -s' show what you want? I believe it parses from /proc/net/snmp.
On Solaris now, or I'd test first......well, maybe.

netstat shows the network layer counters: IP, ICMP, TCP and UDP. I'm looking for the datalink layer counters for Ethernet. ifconfig -a shows what Linux is willing to collect; that is the total packet count, but not the breakdown that SNMP wants. If we look at /proc/net/dev, on versions after 2.2, there is a receive multicast counter (that doesn't show up on ifconfig -a) that is a step in the right direction, but that still doesn't allow me to calculate unicast packets, because I don't know the broadcast count (unless the "packets" value does not include broadcast).
Is there a man page (or other form of documentation) somewhere that explains the meaning of the fields in /proc/net/dev?

Here:
http://www.linuxdevcenter.com/pub/a/...inuxAdmin.html

1 members found this post helpful.

Jules,
Thanks for the pointer. It has a little more info but still doesn't tell me if the multicast counter includes broadcasts or not.
I got kinda excited when I read "If you're [...] hungry for more network-related configuration and statistical information, you should explore the /proc/sys/net/ directory." I went there and found /proc/sys/net/ethernet/! But, alas there is nothing in it (on 2 different Linux systems). Another blind lead. :^(
Looks like I have to learn how to patch the drivers.
Ken

Weird, wonder if it's a kernel option.

I once used a perl snmp module and socket module for this kind of stuff, but it's been a long time, so the details have eroded.

I've been digging into the drivers. On the old Linux (2.4.21) port to the PowerPC that we are using on one product, I can't even figure out how to get at the MAC address to see if it is a multicast or a broadcast. However in the version of Red Hat that we are using on another product (2.6.9), I have found all the counters (burried deep in the driver) and they are 64-bit values (which is what the lastest IF-MIB asks for). Now I just need to figure out how to get them out to the user process. Any ioctl gurus out there? (It's new turf for me.)

I am able to expose the counters on Red Hat 2.6.9. :^) I've created a /proc/net/dev_ifmib "file" which shows the 64-bit Ethernet counters needed to support the IF-MIB. (I only did it for the Ethernet so far. I don't have a need for other interface types yet.) My question now is, "How do I submit my enhancement so that it can become part of all furture releases?" It seems to me that others may want this code and I'd like it to be available on "off the shelf" platforms (without needing to build a special kernel).
ps, I tried to read the MAC address and count the packets on our PowerPC platform (2.4.21), but for some reason that totally eludes me, it causes the kernel to hang. :^(

may you elaborate about exposing/retrieving counters for Ethernet interfaces from the network device drivers: ifInUcastPkts, ifInMulticastPkts, ifInBroadcastPkts, ifOutUcastPkts, ifOutMulticastPkts, ifOutBroadcastPkts