munin plugins for tcp-connection

[Heidenreich Ralf]

Hello,

is a munin plugin available, that shows me in a graph all connections to
my server, divided in ports?
I have a plugin tcp, it shows me the connection like netstat, divided in
established
syn_sent
syn_recv
and os on.
But I need a plugin, that shows me the number of connections, divided in
ports.
Like 2 connections to port 110
3 connections to port 80
and so on.
Can you help me?

greetings ralf

[Nicolai Langfeldt]

Post by Heidenreich Ralf
is a munin plugin available, that shows me in a graph all connections to
my server, divided in ports?

I've not seen that. But "netstat -tn" on linux gives the raw data. It
might be fairly easy to make a netstat_port based on the netstat plugin
to use that as input.

Nicolai

[Gabriele Pohl]

Post by Heidenreich Ralf
is a munin plugin available, that shows me in a graph all connections to
my server, divided in ports?

I advise to use the plugin "port_"

Get the commands to create the multiple links by command:
munin-node-configure --shell --families=manual

and configure a virtual plugin in Munin master configuration
to combine all the curves into one graph
if you want it so.

Cheers,
Gabriele

[Bjørn Ruberg]

Post by Heidenreich Ralf
Hello,
is a munin plugin available, that shows me in a graph all connections to
my server, divided in ports?
I have a plugin tcp, it shows me the connection like netstat, divided in
established
syn_sent
syn_recv
and os on.
But I need a plugin, that shows me the number of connections, divided in
ports.
Like 2 connections to port 110
3 connections to port 80
and so on.
Can you help me?

The "port_" plugin does exactly that, except that it's one tcp port per
plugin - i.e. port_80 shows connections to port 80, port_25 shows
connections to port 25 etc.

A combined plugin may, as Nicolai states, be easy to write; or you can
create a virtual plugin that gathers data from several port_ plugins.

[Andreas Schamanek]

Post by Bjørn Ruberg

Post by Heidenreich Ralf
is a munin plugin available, that shows me in a graph all connections to
my server, divided in ports?

The "port_" plugin does exactly that, except that it's one tcp port
per plugin - i.e. port_80 shows connections to port 80, port_25
shows connections to port 25 etc.
A combined plugin may, as Nicolai states, be easy to write; or you can
create a virtual plugin that gathers data from several port_ plugins.

A virtual plugin that gathers data from others means a lot of
processes where only 1 is needed. I suggest to write your own plugin.
I just did, quick and dirty. You see it is simple.

The netstat information is provided in /proc/net/tcp6 (on modern
systems; e.g. on my Debian box I can ignore /proc/net/tcp). Port
numbers, though, appear as hex numbers. Eg. port 443 (https) = 01BB.

# 8< ---------------------- cut here -------------------------- >8
#!/bin/bash

[ "/$1/" = '/config/' ] \
&& echo "\
graph_title TCP port connection count
graph_args --base 1000 -l 0
graph_vlabel concurrent connections
graph_category network
port21.label port 21
port22.label port 22
port80.label port 80
port143.label port 143
port443.label port 443
port993.label port 993
" && exit

awk 'BEGIN { p21=0; p22=0; p80=0; p143=0; p443=0; p993=0; }
$4 != "01" { next }
$2 ~ /:0015$/ { p21++ }
$2 ~ /:0016$/ { p22++ }
$2 ~ /:0050$/ { p80++ }
$2 ~ /:008F$/ { p143++ }
$2 ~ /:01BB$/ { p443++ }
$2 ~ /:03E1$/ { p993++ }
END {
print "port21.value " p21;
print "port22.value " p22;
print "port80.value " p80;
print "port143.value " p143;
print "port443.value " p443;
print "port993.value " p993;
}' /proc/net/tcp6
# 8< ---------------------- cut here -------------------------- >8

HTH,

[Alan McKay]

Post by Andreas Schamanek
awk 'BEGIN

Such beautiful awk! Thanks for the reminder!

I used to do a lot of awk about 15 years ago but somehow fell out of
the habit. It is a seriously underused tool!