FM / network

/usr/share/systemtap/examples/network

Name	Size	Mode	Actions
autofs4.meta	397	0644	edit dl rm
autofs4.stp	4167	0755	edit dl rm
connect_stat.meta	404	0644	edit dl rm
connect_stat.stp	1019	0755	edit dl rm
dropwatch.meta	494	0644	edit dl rm
dropwatch.stp	900	0755	edit dl rm
netdev.meta	389	0644	edit dl rm
netdev.stp	1458	0755	edit dl rm
netfilter_drop.meta	630	0644	edit dl rm
netfilter_drop.stp	1156	0755	edit dl rm
netfilter_summary.meta	587	0644	edit dl rm
netfilter_summary.stp	591	0755	edit dl rm
netfilter_summary.txt	2873	0644	edit dl rm
netfilter_summary_json.meta	511	0644	edit dl rm
netfilter_summary_json.stp	1070	0644	edit dl rm
nettop.meta	519	0644	edit dl rm
nettop.stp	989	0755	edit dl rm
nettop.txt	953	0644	edit dl rm
net_xmit_json.meta	453	0644	edit dl rm
net_xmit_json.stp	1801	0644	edit dl rm
nfsd-recent.meta	423	0644	edit dl rm
nfsd-recent.stp	442	0755	edit dl rm
nfsd-trace.meta	314	0644	edit dl rm
nfsd-trace.stp	701	0644	edit dl rm
nfsd-trace.txt	876	0644	edit dl rm
nfsdtop.meta	405	0644	edit dl rm
nfsdtop.stp	3385	0755	edit dl rm
nfsd_unlink.meta	479	0644	edit dl rm
nfsd_unlink.stp	523	0755	edit dl rm
packet_contents.meta	550	0644	edit dl rm
packet_contents.stp	216	0755	edit dl rm
packet_contents.txt	2066	0644	edit dl rm
sk_stream_wait_memory.meta	742	0644	edit dl rm
sk_stream_wait_memory.stp	999	0755	edit dl rm
socket-trace.meta	702	0644	edit dl rm
socket-trace.stp	222	0755	edit dl rm
socktop	9144	0755	edit dl rm
socktop.meta	548	0644	edit dl rm
socktop.txt	4135	0644	edit dl rm
stp_dump.meta	339	0644	edit dl rm
stp_dump.stp	568	0644	edit dl rm
stp_dump.txt	1632	0644	edit dl rm
tcpdumplike.meta	381	0644	edit dl rm
tcpdumplike.stp	581	0755	edit dl rm
tcpipstat.meta	725	0644	edit dl rm
tcpipstat.stp	18247	0755	edit dl rm
tcpipstat.txt	898	0644	edit dl rm
tcp_connections.meta	625	0644	edit dl rm
tcp_connections.stp	361	0755	edit dl rm
tcp_init_cwnd.meta	589	0644	edit dl rm
tcp_init_cwnd.stp	343	0755	edit dl rm
tcp_retransmission.meta	286	0644	edit dl rm
tcp_retransmission.stp	1182	0644	edit dl rm
tcp_trace.meta	684	0644	edit dl rm
tcp_trace.stp	19095	0755	edit dl rm
tcp_trace.txt	3465	0644	edit dl rm
who_sent_it.meta	583	0644	edit dl rm
who_sent_it.stp	477	0644	edit dl rm
who_sent_it.txt	803	0644	edit dl rm

Edit: /usr/share/systemtap/examples/network/netfilter_summary.txt (2873B)

netfilter_summary.stp - System-Wide Count of Network Packets by IPs

The script watches all IPv4 network traffic on the system. On exit
  the script prints a list showing the number of packets sent along
  source IP address / destination IP address pair encountered, and the
  total number of bytes sent among the pair. The list is ordered from
  greatest to least number of packets seen among the source/destination
  pairs.

$ stap netfilter_summary.stp -T 10

Collecting data... Type Ctrl-C to exit and display results.
205.251.249.28 -->    10.15.16.105 : 122 packets, 259403 total bytes
 54.218.38.124 -->    10.15.16.105 : 6 packets, 3694 total bytes
  10.15.16.136 -->    10.15.16.255 : 3 packets, 108 total bytes
    10.11.5.19 -->    10.15.16.105 : 3 packets, 408 total bytes
173.194.121.14 -->    10.15.16.105 : 2 packets, 104 total bytes
  10.15.16.206 --> 255.255.255.255 : 2 packets, 280 total bytes
  194.68.29.18 -->    10.15.16.105 : 2 packets, 242 total bytes
  10.15.16.138 --> 255.255.255.255 : 2 packets, 280 total bytes
205.251.242.58 -->    10.15.16.105 : 1 packets, 40 total bytes
  50.58.123.35 -->    10.15.16.105 : 1 packets, 52 total bytes
  10.15.16.114 -->    10.15.16.255 : 1 packets, 228 total bytes
  10.15.16.114 --> 255.255.255.255 : 1 packets, 228 total bytes
54.230.195.233 -->    10.15.16.105 : 1 packets, 52 total bytes
 54.230.192.90 -->    10.15.16.105 : 1 packets, 52 total bytes

The output above was from when the system was doing nothing interesting.

Rerunning the script opening numerous tabs to google.com.

$ stap netfilter_summary.stp -T 10

Collecting data... Type Ctrl-C to exit and display results.
 173.194.37.87 -->    10.15.16.105 : 547 packets, 700864 total bytes
173.194.121.15 -->    10.15.16.105 : 214 packets, 240447 total bytes
 173.194.37.79 -->    10.15.16.105 : 213 packets, 222228 total bytes
 173.194.121.3 -->    10.15.16.105 : 136 packets, 162753 total bytes
205.251.249.28 -->    10.15.16.105 : 115 packets, 215980 total bytes
    10.11.5.19 -->    10.15.16.105 : 71 packets, 8894 total bytes
 173.194.121.9 -->    10.15.16.105 : 66 packets, 58162 total bytes
 173.194.37.81 -->    10.15.16.105 : 52 packets, 11046 total bytes
  54.213.74.85 -->    10.15.16.105 : 4 packets, 908 total bytes
     127.0.0.1 -->       127.0.0.1 : 2 packets, 104 total bytes
  10.10.161.32 -->    10.15.16.105 : 1 packets, 122 total bytes
173.252.100.27 -->    10.15.16.105 : 1 packets, 93 total bytes
  64.32.24.176 -->    10.15.16.105 : 1 packets, 149 total bytes
  10.15.16.136 -->    10.15.16.255 : 1 packets, 36 total bytes
 198.58.96.245 -->    10.15.16.105 : 1 packets, 112 total bytes

Heavily used connections will rise to the top of the list.

The script's output gives a basic understanding of where packets are
being sent to and received from. Other scripts can be used to supplement
the gathered information.

cmd: