Exploring the /proc/net/ Directory
from : http://linuxdevcenter.com/pub/a/linux/2000/11/16/LinuxAdmin.html?page=1
The /proc/ filesystem is a trick the Linux kernel uses to make certain internal information available to user-space processes. The kernel presents the information in virtual files in virtual directories. The files and directories of the /proc/ filesystems are virtual because the data is not actually stored on any sort of permanent storage like a hard disk; instead, the directories, files, and data within them are created dynamically in memory from raw kernel data whenever you attempt to read from them. A variety of network information and data is available in the /proc/net/ directory. In this column we'll take a look at some of the more useful files available in the /proc/net/ subdirectory and how you might use them in administration of your network.
Mounting the /proc/ filesystem
All Linux distributions automatically mount the /proc/ filesystem at boot time. It's not essential that this be done, but a number of programs rely on it, so it's wise.
To see if the /proc filesystem is mounted on your machine, use the mount command without any arguments. You should see output that looks something like this:
mount
..
proc on /proc type proc (rw)
..If not, you can mount the /proc/ filesystem manually using the command:
mount -t proc proc /procand put the following entry into your /etc/fstab file so it is mounted automatically next time you reboot your machine:
proc /proc proc defaults 0 0 The /proc/net/ directory
When the /proc/ filesystem is mounted, you can treat it as though it were a real filesystem containing directories and files. If you move to the /proc/net/ directory and list the files it contains, you will see a list that looks somewhat like the following:
arp ip_fwnames route udp dev ip_mr_cache rpc/ unix dev_mcast ip_mr_vif rt_cache dev_stat netlink snmp igmp netstat sockstat ip_fwchains raw tcp
The actual list of files will vary a little depending on what version kernel you are running and what networking options you've compiled into it.
Each of these files contains information about some aspect of Linux networking. To view the contents of any of these files, you can simply use the cat command. Other utilities such as more or less should work more or less equally well. If you closely inspect these files, you'll see that they're all listed as zero bytes in length in a directory listing; this confuses some programs, so keep this in mind if you strike problems.
Let's take a look at what is inside some of these useful virtual files.
Interface statistics
The /proc/net/dev file contains information about the configured network interfaces. To view it, type cat /proc/net/dev -- you can view sample output here.
If you repeat this command periodically while there is active traffic on your network, you will see some of the numbers changing to reflect the updated statistics collected by the device drivers.
If you examine the format of the file, you'll see that there is one line for each logical network interface known to the kernel. In each line you are given the interface name followed by two sets of nearly identical statistics, receive and transmit, for that interface. The meanings of each of the columns are:
| bytes | The total number of bytes of data transmitted or received by the interface. |
| packets | The total number of packets of data transmitted or received by the interface. |
| errs | The total number of transmit or receive errors detected by the device driver. |
| drop | The total number of packets dropped by the device driver. |
| fifo | The number of FIFO buffer errors. |
| frame | The number of packet framing errors. |
| colls | The number of collisions detected on the interface. |
| compressed | The number of compressed packets transmitted or received by the device driver. (This appears to be unused in the 2.2.15 kernel.) |
| carrier | The number of carrier losses detected by the device driver. |
| multicast | The number of multicast frames transmitted or received by the device driver. |
Socket status
The kernel exports information about open network sockets. The relevant /proc/net/ files for IPv4 are: tcp, udp, and raw. All three files have identical syntax. The first line provides labels for each of the columns in the output. Each following line represents one open socket. Results from cat /proc/net/tcp are shown here.
The data presented in each output column is:
| sl | The number of the line in the output listing. |
| local_address | The local IP address and port number for the socket. The IP address is displayed as a little-endian four-byte hexadecimal number; that is, the least significant byte is listed first, so you'll need to reverse the order of the bytes to convert it to an IP address. The port number is a simple two-byte hexadecimal number. |
| rem_address | The remote IP address and port number for the socket. Encoding is the same as for the local_address. |
| st | The socket status. |
| tx_queue:rx_queue | The size of the transmit and receive queues. |
| tr:tm->when | The tr field indicates whether a timer is active for this socket. A value of zero indicates the timer is not active. The tm->when field indicates the time remaining (in jiffies) before timeout occurs. |
| retrnsmt | Unused. |
| uid | The ID of the user that owns the socket. This is the same ID found in the /etc/passwd file. |
| time-out | Unused. |
| inode | A cryptic-looking number that identifies the socket to the Linux virtual filesystem. |
Routing and ARP tables
The ARP and routing tables are exported in files named arp and route. They're both fairly self-explanatory. The ARP table looks like this.
The fields make sense when you know that HW means "hardware". The hardware type and flag codings are the ARPHRD_* and ATF_* codings found in the /usr/include/linux/if_arp.h file. The Mask field is used when advertising a promiscuous ARP entry for an IP network or subnetwork.
The first entry in the example is for a host on an Ethernet network (hardware type 1). The flags indicate the entry is incomplete; this is further evidenced by the hardware address of 00:00:00:00:00:00, which would normally contain the hardware address of the mapping described by the entry. The second entry is a working ARP entry mapping the IP address 192.168.0.4 to the hardware address 00:80:C8:8B:7A:46 on the network connected to the eth0 device.
The routing table is also easy to understand (view using cat /proc/net/route, and view an example here). Just as for the socket status tables, the IP addresses and network masks are displayed in byte-reversed hexadecimal.
The fields are:
| Iface | The network interface that datagrams matching this route will leave. |
| Destination | In combination with the Mark field, this specifies which datagrams will match this route. |
| Gateway | The IP address of the host that will act as a gateway for datagrams matching this route. |
| Flags | An indicator of a number of route attributes. The flags field values are the RTF_* codings found in the /usr/include/linux/route.h file. |
| RefCnt | Unused. |
| Use | Unused. |
| Metric | The metric value associated with the route. This is used to indicate the cost or priority of a route. |
| Mask | In combination with the Destination field, this specifies which datagrams will match this route. |
| MTU | Specifies the largest TCP segment (in bytes) that will be built for transmission via this route. |
| Window | Specifies the TCP window (in bytes) that will be advertised for TCP connections made via this route. |
| IRTT | Specifies the Initial Round Trip time (in milliseconds) that will be used for TCP connections established via this route. |
The MTU, Window, and IRTT values are per-route values that override those assigned to the interface and allow for some clever ways out of tricky network configurations.
Protocol statistics
The /proc/net/snmp file exports protocol statistic. It is intended to be used by SNMP (Simple Network Management Protocol) daemon programs and provides summary statistics for each of the IP, ICMP, TCP, and UDP protocols. There is a lot of information in this file, so much that I won't discuss it in detail in this column. Refer to the MIB-2 RFC if you're looking for good descriptions of these fields. Suffice it to say that if you're conversant with how the protocols operate, you can gain important insights into how your network is performing by careful analysis of the information presented here.
There is one important thing to note. All of the fields are decimal integers excepting the Ip: Forwarding field, which is a boolean value. In the SNMP world, boolean values are represented with values 1 and 2, so a value of 1 indicates that IP forwarding is disabled.
View the results of cat /proc/net/snmp here.
How do I use this information?
| IP addresses in /proc/net/ In the files offered by the /proc/net/ directory, IP addresses are often represented as little-endian four-byte hexadecimal numbers. These are easy to convert into the more usual dotted-decimal notation. For example, to convert the remote address and port of line 16 of the /proc/net/tcp output shown in this column, we'd do the following: • Take the rem_address field: • Reverse the ordering of the bytes in the IP address part: • Let's separate the bytes of the address for readability: • Perform a simple hexadecimal-to-decimal conversion on each: It's a telnet connection to localhost. Simple enough. |
An important part of the power of the /proc/ filesystem is that all of the files are readable and parsable using just about any program. In the past, the sort of information presented in /proc/ would have been made available via ioctl() function calls against special device files. Using plain-text files means that this information is directly usable by shell scripts, Perl scripts, PHP, and C or C++ programs alike.
It's possible for example to reimplement much of the functionality of the netstat command as a bash shell script. It's a simple task to write a shell script to read data from the /proc/net/ files and write it to a database or flat file for analysis and presentation at a later time, for example, on a web page or report. You could write a Perl script that monitored the data in the /proc/net/dev file and automatically create or destroy additional PPP connections to share network load using EQL. There are many potential uses.
If you're comfortable with the /proc/net/ directory and are hungry for more network-related configuration and statistical information, you should explore the /proc/sys/net/ directory. It contains a whole new level of detail and allows your programs to actually manipulate certain configuration parameters by writing replacement values into the files.