This is the mail archive of the
systemtap@sourceware.org
mailing list for the systemtap project.
TCP probes and message size
- From: Matthew Ward <matthew dot ward at fubra dot com>
- To: systemtap at sourceware dot org
- Date: Thu, 11 Aug 2011 11:15:28 +0100
- Subject: TCP probes and message size
I'm currently implementing a tcp.recvmsg probe as a form of bandwidth
tracking against IP addresses on a KVM guest (as we have lots of IP
addresses pointing to it) and I'm a bit confused as to what the size
represents in terms of HTTP requests and wondered if someone could offer
some advice as to the more complicated workings of systemtap and TCP
that I lack knowledge in :-)
My probe is as follows:
probe tcp.recvmsg {
net_recv[saddr,daddr] <<< size
}
In every case, the source address and destination address are the same.
A single request for a 789B (excluding HTTP headers) HTML page from the
server (served using Apache through an httpd.worker process) requested
using curl results in 3 probe requests; 2 for 1 httpd.worker process for
8512B and 1 for another httpd.worker process for 16384B.
What I basically want to know is, why does a single HTTP request for
789B of data result in 3 probes for tcp.recvmsg that results in 24896B
of data transfer recorded? Is there some way to drill down better in to
this TCP data that systemtap exposes that will give the exact amount of
data sent to the client?
Thanks for any help that any one can give!
--
Matthew Ward
Web and Mobile Application Developer
Fubra Limited
w: www.fubra.com
e: matthew.ward@fubra.com
------------------------------
Fubra is a company limited by shares and registered in England and
Wales with number 3967214 at Anstey Park House, Anstey Road,
Alton, Hampshire, GU34 2RL. We are registered for VAT with number
GB733667024, and as a data controller with number Z5193400.
We are members of RIPE, Nominet, The Italian RA and registered
with OfCom as a provider of electronic communications services.