check_udp ?

[Andreas Ericsson]

Tom Brown wrote:
> 
>>
>> Opening a raw socket and continuously issuing
>>
>>   recv(sd, hdr, sizeof(hdr), MSG_PEEK)
>>
>> on it would be one (very quick) way of getting that data stored.
>> It's not difficult, just pretty bloody useless most of the time.
>> It's nearly always better to just rate-limit the traffic from the
>> start or block it entirely.
>>
>>   
> 
> thanks - we wanted to get this as there are some UDP comms that seem to 
> have ramped up due to buggy code causing other issues so it would have 
> been nice to be able to see if the rate of UDP queries could be alerted 
> on. You can get UDP recieved from netstat -su so issuing that in a loop 
> and comparing the results can be done but its nasty.
> 

Why loop it? Just maintain a timestamp of when it was last done and
compare it with what it is now. Divide by the number of seconds since
last time and you have the rate of udp packets, regardless of how often
you poll. Make sure to consider that the counter may overflow or reset
between runs though, so don't send check_attempts to 1.

-- 
Andreas Ericsson                   andreas.ericsson at op5.se
OP5 AB                             www.op5.se
Tel: +46 8-230225                  Fax: +46 8-230231

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null