Statistics for TCP & UDP Connections

General
1

Hi,

is it possible to have individual statistics for TCP & UDP Packets Per Second including errors and memory used?

for example we can get udp socket memory at /proc/sys/net/ipv4/udp_mem

and from /proc/net/snmp we can get TCP & UDP Packets per second

2

Hi Mike,

Yes, this is definitely possible and a common requirement for deep network analysis. Since you are looking for specific metrics not covered by the standard lnx_if or systemd checks, here is how you can approach this:

1. Data Sources

  • PPS & Errors: The file /proc/net/snmp is the source of truth here.
    • For UDP, look at InDatagrams, OutDatagrams, and InErrors.
    • For TCP, look at InSegs, OutSegs, and RetransSegs.
  • Memory: * Limits: /proc/sys/net/ipv4/udp_mem (Note: Values are in Pages, not Bytes. You’ll need to multiply by your Page Size, usually 4096).
    • Current Usage: /proc/net/sockstat is better for real-time usage (the mem value in the UDP line).

2. Implementation in Checkmk

Since you are on Checkmk 2.4, I recommend using a Local Script or a small Python Agent Plugin.

Check_MK DOKU Local checks

Simple Local Script (Bash) Example:
Place this in /usr/lib/check_mk_agent/local/udp_stats

#!/bin/bash
# Get UDP stats from /proc/net/snmp
udp_line=$(grep "Udp:" /proc/net/snmp | tail -n 1)
in_pps=$(echo $udp_line | awk '{print $2}')
out_pps=$(echo $udp_line | awk '{print $5}')
errs=$(echo $udp_line | awk '{print $3}')

# Get UDP memory from sockstat (value is in pages)
pages=$(grep "UDP:" /proc/net/sockstat | awk '{print $5}')
page_size=$(getconf PAGESIZE)
mem_bytes=$((pages * page_size))

echo "P UDP_PPS in_pps=${in_pps}|out_pps=${out_pps}|errors=${errs} UDP Packets and Errors"
echo "P UDP_Memory mem_used=${mem_bytes} UDP Memory Usage"

3. Why this way?

Directly parsing /proc is much more efficient than calling netstat or ss inside a loop. Checkmk will automatically turn these pipe-separated values into beautiful Perf-O-Meters and graphs.

Hope this helps!

3 Likes
3

Aren’t the the values from /proc/net/snmp are counters?
Does it make sense to plot an increasing counter?
Could it be the case that this is just an answer from a random AI tool and if yes shouldn’t it be marked as AI generated ?

4

You are correct — the values in /proc/net/snmp are monotonically increasing counters since system boot. To get meaningful data, you need to calculate the delta between two samples over a fixed interval:

v1=$(grep "^Tcp:" /proc/net/snmp | tail -1 | awk '{print $12}')
sleep 1
v2=$(grep "^Tcp:" /proc/net/snmp | tail -1 | awk '{print $12}')
echo "RetransSegs/s: $((v2 - v1))"

This gives you the actual rate (e.g. retransmits/sec) rather than a raw ever-growing number. Tools like sar -n TCP or ss -s handle this automatically if you prefer a ready-made solution.

So sorry for the translation mismatch … or missunderstanding

here also the corrected script:

#!/bin/bash
# Get UDP stats from /proc/net/snmp as rates (delta over 1 second)

get_udp_fields() {
    grep "^Udp:" /proc/net/snmp | tail -n 1
}

line1=$(get_udp_fields)
sleep 1
line2=$(get_udp_fields)

in1=$(echo $line1 | awk '{print $2}')
in2=$(echo $line2 | awk '{print $2}')

out1=$(echo $line1 | awk '{print $5}')
out2=$(echo $line2 | awk '{print $5}')

err1=$(echo $line1 | awk '{print $3}')
err2=$(echo $line2 | awk '{print $3}')

in_pps=$((in2  - in1))
out_pps=$((out2 - out1))
errs=$((err2    - err1))

# Get UDP memory from sockstat (value is in pages)
pages=$(grep "^UDP:" /proc/net/sockstat | awk '{print $5}')
page_size=$(getconf PAGESIZE)
mem_bytes=$((pages * page_size))

echo "P UDP_PPS in_pps=${in_pps}|out_pps=${out_pps}|errors=${errs} UDP Packets/s and Errors/s"
echo "P UDP_Memory mem_used=${mem_bytes} UDP Memory Usage"
5

That doesn’t seem like the right approach to me.
I would strongly advise against doing it that way.

If you really want to do it properly,
then you need to calculate the delta between two complete check cycles, not just between two seconds.

BH2005, did you connect your forum account with an AI tool?

6

not really … I`m using some AI just for Translationt hats all …

The seconds was just an example how it works, so the time range its on you to decide what is working for you ... thats why I`m writeing

but in the future I`ll just focus on the German Trouble shooting in my native language

Greetz Bernd