linux - 是否可以计算 Linux 中每个接口(interface)发送/接收的 ICMP 数据包的数量？

Question

是否可以在 Linux 中检查每个接口(interface)的统计信息，尤其是 ICMP 数据包？ ifconfig 命令，它提供每个接口(interface)接收和发送数据包的统计信息:

-> /sbin/ifconfig eth1
eth1      Link encap:Ethernet  HWaddr BC:30:5B:ED:DE:54  
          UP BROADCAST RUNNING SLAVE MULTICAST  MTU:1500  Metric:1
          RX packets:412327300 errors:0 dropped:0 overruns:0 frame:0
          TX packets:765211747 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:327931865613 (312740.1 Mb)  TX bytes:803392590272 (766174.8 Mb)
          Memory:dcc00000-dcd00000 

但我正在寻找的是每个接口(interface)的某种特定类型的数据包(如 ICMP)。

Linux 也在 /proc/net/snmp 中提供这些统计数据:

-> cat /proc/net/snmp
... log truncated ...
Icmp: InMsgs InErrors InDestUnreachs InTimeExcds InParmProbs InSrcQuenchs InRedirects InEchos InEchoReps InTimestamps InTimestampReps InAddrMasks InAddrMaskReps OutMsgs OutErrors OutDestUnreachs OutTimeExcds OutParmProbs OutSrcQuenchs OutRedirects OutEchos OutEchoReps OutTimestamps OutTimestampReps OutAddrMasks OutAddrMaskReps
Icmp: 29697 5 276 9 0 0 0 29409 3 0 0 0 0 29970 0 561 0 0 0 0 5 29404 0 0 0 0
IcmpMsg: InType0 InType3 InType8 InType11 OutType0 OutType3 OutType8
IcmpMsg: 3 276 29409 9 29404 561 5
... log truncated ...

或者使用 netstat -s 命令(当然 -s 代表统计信息)打印更漂亮:

-> netstat -s
... log truncated ...
Icmp:
    29697 ICMP messages received
    5 input ICMP message failed.
    ICMP input histogram:
        destination unreachable: 276
        timeout in transit: 9
        echo requests: 29409
        echo replies: 3
    29970 ICMP messages sent
    0 ICMP messages failed
    ICMP output histogram:
        destination unreachable: 561
        echo request: 5
        echo replies: 29404
IcmpMsg:
        InType0: 3
        InType3: 276
        InType8: 29409
        InType11: 9
        OutType0: 29404
        OutType3: 561
        OutType8: 5
... log truncated ...

所以，问题来了。有什么方法可以获取某些特定接口(interface)的 ICMP 统计信息，而不是 Linux 中整个系统的全局 ICMP 统计信息？

Answer 1

我认为内核不会为每个接口(interface)的每个协议(protocol)保留计数器。查看提供 /proc/net/netstat(以及其他内容)的代码，我们可以找到大量对 rtnl_link_stats64 的引用，它在 include/uapi 中定义/linux/if_link.h:

/* The main device statistics structure */
struct rtnl_link_stats64 {
        __u64   rx_packets;             /* total packets received       */
        __u64   tx_packets;             /* total packets transmitted    */
        __u64   rx_bytes;               /* total bytes received         */
        __u64   tx_bytes;               /* total bytes transmitted      */
        __u64   rx_errors;              /* bad packets received         */
        __u64   tx_errors;              /* packet transmit problems     */
        __u64   rx_dropped;             /* no space in linux buffers    */
        __u64   tx_dropped;             /* no space available in linux  */
        __u64   multicast;              /* multicast packets received   */
        __u64   collisions;

        /* detailed rx_errors: */
        __u64   rx_length_errors;
        __u64   rx_over_errors;         /* receiver ring buff overflow  */
        __u64   rx_crc_errors;          /* recved pkt with crc error    */
        __u64   rx_frame_errors;        /* recv'd frame alignment error */
        __u64   rx_fifo_errors;         /* recv'r fifo overrun          */
        __u64   rx_missed_errors;       /* receiver missed packet       */

        /* detailed tx_errors */
        __u64   tx_aborted_errors;
        __u64   tx_carrier_errors;
        __u64   tx_fifo_errors;
        __u64   tx_heartbeat_errors;
        __u64   tx_window_errors;

        /* for cslip etc */
        __u64   rx_compressed;
        __u64   tx_compressed;
};

如果我没记错的话，这是一种结构，其中每个链接(或每个接口(interface)在这种情况下在语义上是相同的)统计信息被保存并且似乎没有特定于协议(protocol)的计数器。