LinuxDevCenter.com
oreilly.comSafari Books Online.Conferences.

advertisement


Linux Network Administration

Exploring the /proc/net/ Directory

11/16/2000

The /proc/ filesystem is a trick the Linux kernel uses to make certain internal information available to user-space processes. The kernel presents the information in virtual files in virtual directories. The files and directories of the /proc/ filesystems are virtual because the data is not actually stored on any sort of permanent storage like a hard disk; instead, the directories, files, and data within them are created dynamically in memory from raw kernel data whenever you attempt to read from them. A variety of network information and data is available in the /proc/net/ directory. In this column we'll take a look at some of the more useful files available in the /proc/net/ subdirectory and how you might use them in administration of your network.

Mounting the /proc/ filesystem

All Linux distributions automatically mount the /proc/ filesystem at boot time. It's not essential that this be done, but a number of programs rely on it, so it's wise.

To see if the /proc filesystem is mounted on your machine, use the mount command without any arguments. You should see output that looks something like this:

mount
..
proc on /proc type proc (rw)
..

If not, you can mount the /proc/ filesystem manually using the command:

mount -t proc proc /proc

and put the following entry into your /etc/fstab file so it is mounted automatically next time you reboot your machine:

proc /proc proc defaults 0 0 

The /proc/net/ directory

When the /proc/ filesystem is mounted, you can treat it as though it were a real filesystem containing directories and files. If you move to the /proc/net/ directory and list the files it contains, you will see a list that looks somewhat like the following:

arp           ip_fwnames    route      udp
dev           ip_mr_cache   rpc/       unix
dev_mcast     ip_mr_vif     rt_cache  
dev_stat      netlink       snmp
igmp          netstat       sockstat
ip_fwchains   raw           tcp

The actual list of files will vary a little depending on what version kernel you are running and what networking options you've compiled into it.

Each of these files contains information about some aspect of Linux networking. To view the contents of any of these files, you can simply use the cat command. Other utilities such as more or less should work more or less equally well. If you closely inspect these files, you'll see that they're all listed as zero bytes in length in a directory listing; this confuses some programs, so keep this in mind if you strike problems.

Let's take a look at what is inside some of these useful virtual files.

Interface statistics

The /proc/net/dev file contains information about the configured network interfaces. To view it, type cat /proc/net/dev -- you can view sample output here.

If you repeat this command periodically while there is active traffic on your network, you will see some of the numbers changing to reflect the updated statistics collected by the device drivers.

If you examine the format of the file, you'll see that there is one line for each logical network interface known to the kernel. In each line you are given the interface name followed by two sets of nearly identical statistics, receive and transmit, for that interface. The meanings of each of the columns are:

bytes

The total number of bytes of data transmitted or received by the interface.

packets

The total number of packets of data transmitted or received by the interface.

errs

The total number of transmit or receive errors detected by the device driver.

drop

The total number of packets dropped by the device driver.

fifo

The number of FIFO buffer errors.

frame

The number of packet framing errors.

colls

The number of collisions detected on the interface.

compressed

The number of compressed packets transmitted or received by the device driver. (This appears to be unused in the 2.2.15 kernel.)

carrier

The number of carrier losses detected by the device driver.

multicast

The number of multicast frames transmitted or received by the device driver.

Socket status

The kernel exports information about open network sockets. The relevant /proc/net/ files for IPv4 are: tcp, udp, and raw. All three files have identical syntax. The first line provides labels for each of the columns in the output. Each following line represents one open socket. Results from cat /proc/net/tcp are shown here.

The data presented in each output column is:

sl

The number of the line in the output listing.

local_address

The local IP address and port number for the socket. The IP address is displayed as a little-endian four-byte hexadecimal number; that is, the least significant byte is listed first, so you'll need to reverse the order of the bytes to convert it to an IP address. The port number is a simple two-byte hexadecimal number.

rem_address

The remote IP address and port number for the socket. Encoding is the same as for the local_address.

st

The socket status.

tx_queue:rx_queue

The size of the transmit and receive queues.

tr:tm->when

The tr field indicates whether a timer is active for this socket. A value of zero indicates the timer is not active. The tm->when field indicates the time remaining (in jiffies) before timeout occurs.

retrnsmt

Unused.

uid

The ID of the user that owns the socket. This is the same ID found in the /etc/passwd file.

time-out

Unused.

inode

A cryptic-looking number that identifies the socket to the Linux virtual filesystem.



Pages: 1, 2

Next Pagearrow




Linux Online Certification

Linux/Unix System Administration Certificate Series
Linux/Unix System Administration Certificate Series — This course series targets both beginning and intermediate Linux/Unix users who want to acquire advanced system administration skills, and to back those skills up with a Certificate from the University of Illinois Office of Continuing Education.

Enroll today!


Linux Resources
  • Linux Online
  • The Linux FAQ
  • linux.java.net
  • Linux Kernel Archives
  • Kernel Traffic
  • DistroWatch.com


  • Sponsored by: