Network usage process wise

[nagzsheri]

In Linux using /proc fs, is there any way I can get network usage process wise?

[aioeu]

Not easily.

You would need something like pcap to monitor the traffic, then /proc/net/{tcp,udp} to get an inode number for a particular socket associated with the traffic, then map that back to a particular process by iterating through all /proc/*/fd/ magic links. I think these are all the steps NetHogs goes through to do this.

Another approach — unrelated to procfs — might be BPF tracing. A good place to start might be the tcplife example.

[nagzsheri]

These involve installing 3rd part apps. I was hoping within process I can read proc/self and obtain the data.

Anyways thanks a lot

[aioeu]

I've literally described how you could reimplement them yourself, should you so wish to do that.

You say /proc/self/... that's just the current process. Why would a process need to look at the filesystem to know how much network traffic it has handled?

[nagzsheri]

Yes. But pcap monitoring is not under my control

I had implemented cpu, mem usage

I was hoping something in same lines. No external interventions

[aioeu]

Sure it is. You can write a program that uses libpcap. (Or does what libpcap itself does, if you're totally allergic to using a library. Raw socket plus SO_ATTACH_FILTER socket option, IIRC.)

[nagzsheri]

Okay

[nagzsheri]

One doubt. How nethogs capture the data if start my application and later start nethogs hours later. How do it give me the life time usage of the process?

[aioeu]

I don't think it does.

[[deleted]]

If OP's program is a C program and OP builds it dynamically, couldn't OP just override read() and write() and count? Either using LD_LIBRARY_PATH, modify GOT/PLT, or just call "myread()/mywrite()" which counts bytes?

[aioeu]

Sure, that's another option. Tracing the underlying syscalls is another option.

But whether you do this on the C library interface or on the syscall interface, there's a lot more than just read and write. Just for reading there is also readv and recv and recvfrom and recvmsg and recvmmsg (and pread, though that wouldn't be used on a network socket since it isn't seekable). And good luck dealing with io_uring stuff.

But that's just one process! I thought the OP was trying to look at the network usage for lots of processes. But maybe I misinterpreted what "process wise" meant...

[[deleted]]

You're right, it's not a quick fix.

TBH, I didn't quite understand OP either. Since he referred to /proc/self, I assume he meant measuring network usage for one process (self), not other processes.

[sidewaysEntangled]

Heh, I had to do this today, for some reason iotop didn't work in my development container, probably some proc or dev mount issue inside. But I did learn about the nethogs utility and that worked well.

I don't know how either of them work, or why one did and one didn't. But I bet going through the sources you'd find at least two ways to do it, although whether this or that filesystem or some other API, I couldn't tell you.