check_udp ?

[Andreas Ericsson]

Marc Powell wrote:
> On Nov 18, 2008, at 8:21 AM, Tom Brown wrote:
> 
>> Hi
>>
>> Does anyone know if there is a plugin that can monitor UDP statistics
>> and then warn when thresholds are met.
>>
>> ie more than x UDP packets seen on a port then warn? Or something  
>> similar?
> 
> I've never seen one and am not aware of any system counter that tracks  
> that. Do you know of one?

There are iptables modules for it in Linux, although it probably requires
a bit of a head-start.

> I believe you'd either have to get that  
> information from the daemon running on that port (if it supported it),  
> or use some kind of packet capture methodology to passively watch and  
> count them.
> 

Opening a raw socket and continuously issuing

  recv(sd, hdr, sizeof(hdr), MSG_PEEK)

on it would be one (very quick) way of getting that data stored.
It's not difficult, just pretty bloody useless most of the time.
It's nearly always better to just rate-limit the traffic from the
start or block it entirely.

-- 
Andreas Ericsson                   andreas.ericsson at op5.se
OP5 AB                             www.op5.se
Tel: +46 8-230225                  Fax: +46 8-230231

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null