monitoring bytes processed off network interface in user space

From: marty
Date: Sat Oct 18 2008 - 13:10:12 EST

I want to be able to see if user space is processing network traffic
(as opposed to raw rx/tx packets on the interface).

Is there a way to track this? (beyond modifying all the applications which
deal with the network). I need to track traffic to/from userspace to a
"specific" interface, not things like localhost.

Note, this is an embedded system talking (at times) appletalk,novell, ipv4, ipv6 and maybe other things...

Currently we have something like

while(1) {
WOL packet
timeout on no activity on rx/tx counts and then go sleep

Unfortunatley, rx/tx activity won't solve the problem on a busy lan with lots of broadcast packets. If our WOL filter will only wake us on (lets say) on directed TCP/UDP packets, a constant ping will prevent us from going back to sleep...

If there isn't a way to do this, it may be simple to add some counters
in the right places in the network stacks (instead of packets, it would be bytes).


Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at