mbuf question again

[Dmitry V.Galant]

On Tue, Apr 01, 2003 at 11:34:03AM +0200, Stalker wrote:
> 
> Hi
> 
> I would like to know if it is possible to write a program to check which
> mbuf's are allocated to which programs that are currently running, or is
> this totally not possible?
> 
> If it is possible, could someone point me in the right direction as in which
> libraries / functions / reading material i would need to look at in order to
> do so?


	It's not so easy.
	mbuf objects primary used to represent fragmented
	packet in the system or incapsulated packet as list
	of protocols headers and packet data.

	mbuf objects are allocated when NIC receive packet
	and transfer it from NIC's memory to main RAM.
	In that moment mbuf object is unqueued and referenced
	only by interface driver code so you cant find
	a system structure points to mbuf object.

	Packet incapsulated in mbuf object can be bridged out,
	fast-forwarded or queued for other processing. 

	Network stack then dequeue it and pop it up until
	packet is added to process socket buffer sockbuf
	(see sys/socketvar.h)

	[*] At this moment you can map mbufs against running processes.
	But in the context of fixing network problems it can
	be total useless to view this mapping.

	Same process is on sending packets.

	Theoretically it's possible to write kernel module to
	print all allocated mbufs in the system but it's much easy
	just to coredump the kernel, save core and use
	gdb for browsing.