Documentation/networking/snmp_counter.rst

1038   nstatuser@nstat-a:~$ ping 8.8.8.8 -c 1
1048   nstatuser@nstat-a:~$ nstat
1082   nstatuser@nstat-b:~$ nc -lknv 0.0.0.0 9000
1087   nstatuser@nstat-a:~$ nc -nv 192.168.122.251 9000
1093 On server side, we can find below nstat output::
1095   nstatuser@nstat-b:~$ nstat | grep -i tcp
1101 On client side, we can find below nstat output::
1103   nstatuser@nstat-a:~$ nstat | grep -i tcp
1124   nstatuser@nstat-b:~$ nc -lkv 0.0.0.0 9000
1129   nstatuser@nstat-a:~$ nc -v nstat-b 9000
1130   Connection to nstat-b 9000 port [tcp/*] succeeded!
1134   nstatuser@nstat-a:~$ nc -v nstat-b 9000
1135   Connection to nstat-b 9000 port [tcp/*] succeeded!
1138 The client side nstat output::
1140   nstatuser@nstat-a:~$ nstat
1153 The server side nstat output::
1155   nstatuser@nstat-b:~$ nstat
1168   nstatuser@nstat-a:~$ nc -v nstat-b 9000
1169   Connection to nstat-b 9000 port [tcp/*] succeeded!
1173 Client side nstat output::
1175   nstatuser@nstat-a:~$ nstat
1189 Server side nstat output::
1191   nstatuser@nstat-b:~$ nstat
1203 Compare the first client-side nstat and the second client-side nstat,
1206 nstat and the second server-side nstat had a difference too: the
1207 second server-side nstat had a TcpExtTCPHPHits, but the first
1208 server-side nstat didn't have it. The network traffic patterns were
1219   nstatuser@nstat-a:~$ ss -o state established -i '( dport = :9000 or sport = :9000 )
1225 option to 7. Now we could explain the nstat output in our test:
1227 In the first nstat output of client side, the client sent a packet, server
1231 In the second nstat output of client side, the client sent a packet again,
1236 In the first nstat output of server side, fast path was not enabled,
1239 In the second nstat output of server side, the fast path was enabled,
1264   nstatuser@nstat-a:~$ echo "hello" | nc nstat-b 9000
1271   nstatuser@nstat-b:~$ nstat | grep -i abort
1287   nstatuser@nstat-a:~$ cat client_orphan.py
1291   server = 'nstat-b' # server address
1309   nstatuser@nstat-b:~$ cat server_orphan.py
1343   nstatuser@nstat-a:~$ nstat | grep -i abort
1348   nstatuser@nstat-a:~$ ss -s
1396   nstatuser@nstat-a:~$ nstat | grep -i abort
1403   nstatuser@nstat-b:~$ cat server_linger.py
1418   nstatuser@nstat-a:~$ cat client_linger.py
1422   server = 'nstat-b' # server address
1433   nstatuser@nstat-b:~$ python3 server_linger.py
1437   nstatuser@nstat-a:~$ python3 client_linger.py
1439 After run client_linger.py, check the output of nstat::
1441   nstatuser@nstat-a:~$ nstat | grep -i abort
1466   server = 'nstat-b'
1473   nstatuser@nstat-a:~$ python3 -i client_coalesce.py
1485 On the server, run nstat::
1487   ubuntu@nstat-b:~$ nstat
1508   nstatuser@nstat-b:~$ nc -lkv 0.0.0.0 9000
1513   nstatuser@nstat-a:~$ nc -v nstat-b 9000
1514   Connection to nstat-b 9000 port [tcp/*] succeeded!
1521 Before running the 4th nc, we clean the nstat history on the server::
1523   nstatuser@nstat-b:~$ nstat -n
1527   nstatuser@nstat-a:~$ nc -v nstat-b 9000
1534 on half open queue. I did the test on kernel 4.15. Below is the nstat
1537   nstatuser@nstat-b:~$ nstat
1548 between the 4th nc and the nstat was longer, the value of
1580 On server B, we check the output of nstat::
1582   $ nstat
1612 On server B, run nstat::
1614   $ nstat
1637 Run nstat on server B::
1639   $ nstat
1659   nstatuser@nstat-a:~$ sudo tcpdump -c 1 -w /tmp/syn.pcap port 9000
1664   nstatuser@nstat-a:~$ nc nstat-b 9000
1666 As the nstat-b didn't listen on port 9000, it should reply a RST, and
1672   nstatuser@nstat-a:~$ tcprewrite --infile=/tmp/syn.pcap --outfile=/tmp/syn_fixcsum.pcap --fixcsum
1674 On nstat-b, we run nc to listen on port 9000::
1676   nstatuser@nstat-b:~$ nc -lkv 9000
1679 On nstat-a, we blocked the packet from port 9000, or nstat-a would send
1680 RST to nstat-b::
1682   nstatuser@nstat-a:~$ sudo iptables -A INPUT -p tcp --sport 9000 -j DROP
1684 Send 3 SYN repeatly to nstat-b::
1686   nstatuser@nstat-a:~$ for i in {1..3}; do sudo tcpreplay -i ens3 /tmp/syn_fixcsum.pcap; done
1688 Check snmp cunter on nstat-b::
1690   nstatuser@nstat-b:~$ nstat | grep -i skip
1699 On nstat-b, let nc listen on port 9000::
1701   nstatuser@nstat-b:~$ nc -lkv 9000
1704 On nstat-a, run tcpdump to capture a SYN::
1706   nstatuser@nstat-a:~$ sudo tcpdump -w /tmp/paws_pre.pcap -c 1 port 9000
1709 On nstat-a, run nc as a client to connect nstat-b::
1711   nstatuser@nstat-a:~$ nc -v nstat-b 9000
1712   Connection to nstat-b 9000 port [tcp/*] succeeded!
1717   nstatuser@nstat-a:~$ tcprewrite --infile /tmp/paws_pre.pcap --outfile /tmp/paws.pcap --fixcsum
1721   nstatuser@nstat-a:~$ for i in {1..2}; do sudo tcpreplay -i ens3 /tmp/paws.pcap; done
1723 On nstat-b, check the snmp counter::
1725   nstatuser@nstat-b:~$ nstat | grep -i skip
1729 failed, the nstat-b replied an ACK for the first SYN, skipped the ACK
1743 On nstat-b, open two terminals, run two nc commands to listen on both
1746   nstatuser@nstat-b:~$ nc -lkv 9000
1749   nstatuser@nstat-b:~$ nc -lkv 9001
1752 On nstat-a, run two nc clients::
1754   nstatuser@nstat-a:~$ nc -v nstat-b 9000
1755   Connection to nstat-b 9000 port [tcp/*] succeeded!
1757   nstatuser@nstat-a:~$ nc -v nstat-b 9001
1758   Connection to nstat-b 9001 port [tcp/*] succeeded!
1760 On nstat-a, run tcpdump to capture an ACK::
1762   nstatuser@nstat-a:~$ sudo tcpdump -w /tmp/seq_pre.pcap -c 1 dst port 9001
1765 On nstat-b, send a packet via the port 9001 socket. E.g. we sent a
1768   nstatuser@nstat-b:~$ nc -lkv 9001
1770   Connection from nstat-a 42132 received!
1773 On nstat-a, the tcpdump should have caputred the ACK. We should check
1776   nstatuser@nstat-a:~$ ss -ta '( dport = :9000 || dport = :9001 )' | tee
1784 …nstatuser@nstat-a:~$ tcprewrite --infile /tmp/seq_pre.pcap --outfile /tmp/seq.pcap -r 9001:9000 -r…
1786 Now the /tmp/seq.pcap is the packet we need. Send it to nstat-b::
1788   nstatuser@nstat-a:~$ for i in {1..2}; do sudo tcpreplay -i ens3 /tmp/seq.pcap; done
1790 Check TcpExtTCPACKSkippedSeq on nstat-b::
1792   nstatuser@nstat-b:~$ nstat | grep -i skip