3

I'm working on a network monitor for Linux, without packet sniffing. I'm planning to read the network statistics and related data from /proc/net files.

I know that /proc is the mount point of process file system which is a virtual file system that reflects the kernel internal data structure.

I like to know how is it populated and is it possible to read the OS internals directly.

HalosGhost
  • 4,790
nkg
  • 159
  • 1
  • 6

1 Answers1

2

/proc is populated “live” by the kernel: the contents of the directories and files are built on the fly when an application accesses them. So you won't find any utility that populates them: if you want to know how things get there, you'll have to read the kernel code or the kernel documentation. In the source code, entries are created by various parts of the networking code. Many entries in /proc/net are documented as part of the networking documentation.

This is as low-level as it gets to read the OS internals. The only way to get any deeper is to write a kernel driver.

Another way to retrieve networking-related information is via ioctl and getsockopt calls on sockets. This is sometimes more convenient in C. I think there's information that you can get by one method but not by the other method and vice versa but I don't know the details.

Gilles 'SO- stop being evil'
  • 829,060
  • Is it possible to get a specific process network usage from there? – android developer Jun 29 '19 at 06:28
  • 1
    @androiddeveloper For a specific process, look under /proc/$pid/fd and /proc/$pid/fdinfo. lsof -p$pid gives you a list as well. – Gilles 'SO- stop being evil' Jun 29 '19 at 09:41
  • I've looked at some folders of /proc/$pid/fd and /proc/$pid/fdinfo. Some are empty, and some has weird content (I see just numbers when I write ls) . As for lsof -p$pid , it shows some info, but which of them is of network usage? Do you know of some article or StackOverflow question about this? I want to get the total network usage of an app so far on Android, and since Android Q got restricted in this (here: https://stackoverflow.com/q/56611173/878126 ) , I'm trying my luck with root access. EDIT: found something else that could help me: https://stackoverflow.com/a/29357619/878126 – android developer Jun 29 '19 at 10:50
  • @androiddeveloper It depends what you're looking for, which you haven't stated. Do you want to know what sites the process connects to? Do you want to know how much bandwidth it's consuming in real time? Do you want to have a report of how much bandwidth it's consumed altogether since it started? In any case, this is very different from the question here, so if you can't find what you're looking for (these topics have come up often on this site so please do search), you should ask a new question, not comment here. – Gilles 'SO- stop being evil' Jun 29 '19 at 11:09
  • Actually I wrote about it here: https://stackoverflow.com/q/56611173/878126 . It's total specific app's bandwidth usage so far (since some specific time-your choice). Maybe I should write about it here too? However, for now I have a solution for rooted devices anyway (got the subscriberId, AKA IMEI , and then used normal framework API). Still could be nice to know if there is such a solution on Linux in general, and maybe it will work on Android too. – android developer Jun 29 '19 at 15:54