# Network Profiling

WAR STORY: Top network users by PID http://sourceware.org/systemtap/wiki/WSNetTop?highlight=((WarStories)) probably http://sourceware.org/systemtap/examples/network/nettop.stp

This section describes how to profile network activity. provides a glimpse into how much network traffic each process is generating on a machine.

nettop.stp

Note that `function print_activity()` uses the following expressions:

    n_xmit ? @sum(ifxmit[pid, dev, exec, uid])/1024 : 0
    n_recv ? @sum(ifrecv[pid, dev, exec, uid])/1024 : 0

These expressions are if/else conditionals. The first statement is simply a more concise way of writing the following psuedo code:

    if n_recv != 0 then
      @sum(ifrecv[pid, dev, exec, uid])/1024
    else
      0

tracks which processes are generating network traffic on the system, and provides the following information about each process:

- `PID` — the ID of the listed process.

- `UID` — user ID. A user ID of `0` refers to the root user.

- `DEV` — which ethernet device the process used to send / receive data (e.g. eth0, eth1)

- `XMIT_PK` — number of packets transmitted by the process

- `RECV_PK` — number of packets received by the process

- `XMIT_KB` — amount of data sent by the process, in kilobytes

- `RECV_KB` — amount of data received by the service, in kilobytes

provides network profile sampling every 5 seconds. You can change this setting by editing `probe timer.ms(5000)` accordingly. contains an excerpt of the output from over a 20-second period:

Sample Output

    [...]
      PID   UID DEV     XMIT_PK RECV_PK XMIT_KB RECV_KB COMMAND
        0     0 eth0          0       5       0       0 swapper
    11178     0 eth0          2       0       0       0 synergyc

      PID   UID DEV     XMIT_PK RECV_PK XMIT_KB RECV_KB COMMAND
     2886     4 eth0         79       0       5       0 cups-polld
    11362     0 eth0          0      61       0       5 firefox
        0     0 eth0          3      32       0       3 swapper
     2886     4 lo            4       4       0       0 cups-polld
    11178     0 eth0          3       0       0       0 synergyc

      PID   UID DEV     XMIT_PK RECV_PK XMIT_KB RECV_KB COMMAND
        0     0 eth0          0       6       0       0 swapper
     2886     4 lo            2       2       0       0 cups-polld
    11178     0 eth0          3       0       0       0 synergyc
     3611     0 eth0          0       1       0       0 Xorg

      PID   UID DEV     XMIT_PK RECV_PK XMIT_KB RECV_KB COMMAND
        0     0 eth0          3      42       0       2 swapper
    11178     0 eth0         43       1       3       0 synergyc
    11362     0 eth0          0       7       0       0 firefox
     3897     0 eth0          0       1       0       0 multiload-apple
    [...]

script examples network profiling
examples of SystemTap scripts network profiling
network profiling examples of SystemTap scripts
profiling the network examples of SystemTap scripts
network traffic, monitoring examples of SystemTap scripts
script examples if/else conditionals, alternative syntax
examples of SystemTap scripts if/else conditionals, alternative syntax
if/else conditionals, alternative syntax examples of SystemTap scripts