最近在进行抓包重组方面的编程学习，在代码写完了之后需要对抓包性能进行分析，其中比较重要的一点就是丢包率，这点异常关键，如果丢包率高了，那方案可能就需要重新设计了。但如何了解在一个高速网络I/O情况下程序的丢包率呢？一种比较容易想到的方式就是和tcpdump的抓包效果进行对比，但因为tcpdump底层依赖的是libpcap库，当网络I/O较大时，它也会出现丢包的情况，所以准确性有待商榷；还有一种方式就是读取Linux系统中的某些特定文件获取相关信息（这个应该是一种比较简单也较为准确的方法，简单说的是方法简单——读文件然后进行相关换算就行，为什么是较为准确，而不是准确呢？因为该文件中存放的是总体的信息，无法像tcpdump那样根据某些规则进行过滤，计算的是一个总数，所以与实际相比值要偏大一些），下面就记录一下该方法：

搜索关键字：

• http://search.aol.com/aol/search?q=linux+%2Fproc%2Fnet%2Fdev
• http://search.aol.com/aol/search?q=linux+%2Fsys%2Fclass%2Fnet%2Feth0%2Fstatistics%2Frx_packets

参考关键字：

/proc/net/dev

/proc/net/raw -- RAW socket information
/proc/net/tcp -- TCP socket information
/proc/net/udp -- UDP socket information

/sys/class/net/eth0/statistics/rx_bytes
/sys/class/net/eth0/statistics/rx_packets
/sys/class/net/eth0/statistics/tx_bytes
/sys/class/net/eth0/statistics/tx_packets

==

There are many traffic monitoring tools available on Linux, which can monitor/classify network traffic, and report real-time traffic statistics in fancy user interfaces. Most of these tools (e.g., ntopng, iftop) are powered by libpcap, which is a packet capture library used to monitor network traffic in user space. Despite their versatility, however, libpcap-based network monitoring tools cannot scale to handle traffic on multi Gigabit rate network interfaces, due to the overhead associated with user-space packet capture.（虽然基于libpcap的网络监控工具功能齐全，但是因为用户态抓包能力的先天性限制，它们无法扩展去处理Gigabit速率的网络接口。）

In this tutorial, I will present simple shell scripts that can monitor network traffic on per-interface basis, without relying on slow libpcap library. These scripts are fast enough to support multi Gigabit rates, but only suitable if you are interested in “aggregate” network statistics on per interface basis.（下面的脚本只适用于对总体的网卡流量进行统计的情形）

The secret for the scripts lies in sysfs virtual filesystem which is used by the kernel to export device- or driver-related information to user space. Network interface related statistics are exported via /sys/class/net/<ethX>/statistics.（因为内核将设备、驱动相关的信息导出至用户态的 sysfs 虚拟文件系统的相应文件中）

For example, the statistics on eth0 interface are found in these files:

• /sys/class/net/eth0/statistics/rx_packets: number of packets received
• /sys/class/net/eth0/statistics/tx_packets: number of packets transmitted
• /sys/class/net/eth0/statistics/rx_bytes: number of bytes received
• /sys/class/net/eth0/statistics/tx_bytes: number of bytes transmitted
• /sys/class/net/eth0/statistics/rx_dropped: number of packets dropped while received
• /sys/class/net/eth0/statistics/tx_dropped: number of packets dropped while transmitted

The numbers stored in the files are automatically refreshed in real-time by the kernel. Therefore, you can write scripts that calculate traffic statistics based on these files.

The following are two such scripts (thanks to joemiller). The first script counts the number of packets per second, received (RX) or sent (TX) on an interface, while the latter scripts measures the network bandwidth of incoming (RX) and outgoing (TX) traffic on an interface.

Reference:

http://xmodulo.com/measure-packets-per-second-throughput-high-speed-network-interface.html

#!/bin/bash

interval="1"  # update interval in seconds
interface_name=$(awk '$1 !~ /lo/' /proc/net/dev | awk 'BEGIN{max=0} {if($2+0 > max+0) max=$2 fi} END{print $1}' | awk -F':' '{print $1}')

while true
do
	R1=`cat /sys/class/net/$interface_name/statistics/rx_packets`
	T1=`cat /sys/class/net/$interface_name/statistics/tx_packets`
	rb1=`cat /sys/class/net/$interface_name/statistics/rx_bytes`
	tb1=`cat /sys/class/net/$interface_name/statistics/tx_bytes`
	sleep $interval
	R2=`cat /sys/class/net/$interface_name/statistics/rx_packets`
	T2=`cat /sys/class/net/$interface_name/statistics/tx_packets`
	rb2=`cat /sys/class/net/$interface_name/statistics/rx_bytes`
	tb2=`cat /sys/class/net/$interface_name/statistics/tx_bytes`
	TXPPS=`expr $T2 - $T1`
	RXPPS=`expr $R2 - $R1`
	TBPS=`expr $tb2 - $tb1`
	RBPS=`expr $rb2 - $rb1`
	TKBPS=`expr $TBPS / 1024`
	RKBPS=`expr $RBPS / 1024`
	echo -e "Send $interface_name: $TXPPS pkts/s\tRecv $interface_name: $RXPPS pkts/s"
	echo -e "Send $interface_name: $TKBPS KB/s\tRecv $interface_name: $RKBPS KB/s"
done

==

参考链接：

• How to measure packets per second or throughput on high speed network interface – Xmodulo
• http://serverfault.com/questions/533513/how-to-get-tx-rx-bytes-without-ifconfig
• http://stackoverflow.com/questions/349576/linux-retrieve-per-interface-sent-received-packet-counters-ethernet-ipv4-ipv
• http://stackoverflow.com/questions/3521678/linux-what-are-means-of-fields-in-proc-net-dev