monitor TCP connections

[wikisb]

hi all!
i would like to monitor the tcp connections in any host but i don't know how to do it. i only use SNMP. i had a look to the TCP-MIB and google but nothing...
i guess that you have to do something with the tcpConnTable OID: 1.3.6.1.2.1.6.13. but i don't manage to solve this issue.
Thanks!!

[caraconan]

I'm playing a bit with this.

I cloned 'Template SNMP Interfaces' and adapting to this SNMP MIB.

My current problem is how to access to 'TCP-MIB::tcpListenerProcess.ipv4' indexes:

$ snmpwalk -v 2c -c jj.com test-5.dev TCP-MIB::tcpListenerProcess.ipv4
TCP-MIB::tcpListenerProcess.ipv4."0.0.0.0".22 = Gauge32: 0
TCP-MIB::tcpListenerProcess.ipv4."0.0.0.0".111 = Gauge32: 0
TCP-MIB::tcpListenerProcess.ipv4."0.0.0.0".10050 = Gauge32: 0
TCP-MIB::tcpListenerProcess.ipv4."0.0.0.0".43430 = Gauge32: 0
TCP-MIB::tcpListenerProcess.ipv4."0.0.0.0".60458 = Gauge32: 0
TCP-MIB::tcpListenerProcess.ipv4."127.0.0.1".25 = Gauge32: 0

$ snmpwalk -v 2c -c jj.com test-5.dev TCP-MIB::tcpListenerProcess.ipv4.\"0\.0\.0\.0\"
TCP-MIB::tcpListenerProcess.ipv4."0.0.0.0" = No Such Instance currently exists at this OID

I'll post here my progress.

Regards.

Javier

[alledm]

I use iptstate to count tcp connections.

just create a UserParameter like

UserParameter=iptstate[*],sudo iptstate -1 |  awk '$$3 == "$1" && $$4 == "$2" { total = total + 1 } ; END { print total }'

Load the iptstate modules

modprobe nf_conntrack_ipv4
modprobe nf_conntrack ipv6

install iptstate and give SUDO permission to zabbix to run it.

Use it like

zabbix_agentd --test iptstate[tcp,ESTABLISHED]

[BDiE8VNy]

Another way to gather current tcp information might be (not tested, written from memory):

UserParameter=proc.net.tcp.count.established,/bin/grep -Ec '[0-9A-F]{8}:[0-9A-F]{4} [0-9A-F]{8}:[0-9A-F]{4} 01' /proc/net/tcp
UserParameter=proc.net.tcp6.count.established,/bin/grep -Ec '[0-9A-F]{32}:[0-9A-F]{4} [0-9A-F]{32}:[0-9A-F]{4} 01' /proc/net/tcp6

UserParameter=proc.net.tcp.count[*],/bin/grep -Ec '[0-9A-F]{8}:[0-9A-F]{4} [0-9A-F]{8}:[0-9A-F]{4} $1' /proc/net/tcp
UserParameter=proc.net.tcp6.count[*],/bin/grep -Ec '[0-9A-F]{32}:[0-9A-F]{4} [0-9A-F]{32}:[0-9A-F]{4} $1' /proc/net/tcp6

# connections established
zabbix_agentd --test proc.net.tcp.count.established
zabbix_agentd --test proc.net.tcp6.count.established

# tcp sockets listening
zabbix_agentd --test proc.net.tcp.count["0A"]
zabbix_agentd --test proc.net.tcp6.count["0A"]