Getting a specific value from netstat

[Paul Hoffman]

At 9:42 AM -0500 9/18/06, Dan Nelson wrote:
>In the last episode (Sep 17), Paul Hoffman said:
>  > Greetings again. If I do a 'netstat -I em0 -b', I get:
>>
>>  Name    Mtu Network       Address              Ipkts Ierrs 
>>Ibytes  Opkts Oerrs     Obytes  Coll
>>  em0    1500 <Link#1>      00:0e:0c:67:c8:04 93555198     0 
>>2179562966  114493253     0  723565977     0
>>  em0    1500 fe80:1::20e:c fe80:1::20e:cff:f        0     - 
>>0  4     -        288     -
>>  em0    1500 192.245.12    Balder-227        35399016     - 
>>1770283188  114484197     - 3415268168     -
>>  em0    1500 192.245.12.22 Balder-228        27063120     - 
>>1655024896  0     -          0     -
>>  em0    1500 192.245.12.22 Balder-229        47427840     - 
>>3954775975  18975500     - 2445620452     -
>>
>>  What I care about is the number of input and output bytes (in this
>>  case, 2179562966 and 723565977). I can write a short Perl script to
>>  parse the netstat output, but I would rather just get the numbers
>>  directly from the OS. Are these values available without going
>>  through netstat?
>
>If you use the same code netstat does, yes :)  It looks like
>per-interface stats are still obtained by grovelling through /dev/kmem,
>though, so it may be easier to just parse netstat's output.

Yes, probably so. The quick-and-dirty Perl script I wrote is:

$ThisNetStat = `/usr/bin/netstat -I em0 -b`;
@Lines = split(/^/, $ThisNetStat);
$TheLine = $Lines[1];
$TheLine =~ s/ ( )*/ /g;
@Fields = split(/ /, $TheLine);
$InBytes =  $Fields[6];
$OutBytes = $Fields[9];

*However*, I now see that the byte numbers from netstat seem to wrap 
around at about 4 gigabytes. I'll have to add some code to handle 
that over the long term, given that my system puts out that much in a 
day...

>Another
>alternative would be to install net-snmp and ask it for the stats.

I thought SNMP stood for "Simply Not My Problem"? :-)

--Paul Hoffman