RPC.ETHERD(8)RPC.ETHERD(8)NAME
rpc.etherd, etherd - network statistic server
SYNOPSISrpc.etherd [ -d ] interface
DESCRIPTIONrpc.etherd is a value added replacement for the SunOS pro-
gram rpc.etherd which runs on DEC Ultrix, Linux and BSD-
ish systems with Berkeley Packet Filter.
The -d option increases the debugging verbosity level, if
the program was compiled for it.
rpc.etherd gathers statistics about the network as seen
from the given network interface. rpc.etherd must be run
as root, as it places the interface in promiscuous mode.
rpc.etherd requires a front end to display the statistics,
such as tkined (1).
The reporting of these statistics is via SUN remote proce-
dure call (RPC).
Although rpc.etherd is designed to emulate the SunOS
rpc.etherd in every way, the exceptions are:
Statistics for "other" include both IP and other
protocols not categorized by the ether.x specifica-
tion.
When the protocol filters are in operation, the
"other" field still reports "other" protocols. The
SunOS version does not.
Regardless of the IP packet type, host statistics
are kept for each IP host. This means that if a
host is sending out large amounts of IGMP messages,
these will register. The SunOS version may or may
not do this. It is reasonably difficult to verify
at this time.
This program causes a substancial performance impact
because it reads ALL packets which arrive on the network
interface. A large queue is allocated both within the
kernel and in user space. A packet filter could be writ-
ten to overcome this somewhat, but then the network
statistics would only report what the packet filter let
through.
rpc.etherd was written to provide DEC users with a proper
back end for the ethertop program by the same author. It
was written in a "clean room / black box" environment,
meaning without knowlege of SunOS source code. As a
result, obscure features and bugs may be present in both
5 October 1992 1
RPC.ETHERD(8)RPC.ETHERD(8)
implementations.
SEE ALSO
tcpdump (1), tkined (1)
DIAGNOSTICS
Error messages are reported via syslog(3).
If compiled for debugging, it will spew to stderr too many
information to be useful.
BUGS
A filter of any kind applied by a client program will
affect all clients making RPC calls. Any client that
calls the etherproc_off procedure will turn of the inter-
face monitoring, thus rendering other clients useless.
The ether.x protocol is flawed. Host addresses are passed
as int's rather than struct in_addr's. This causes unnec-
essary byte swapping of network addresses that are already
in network order. This rpc.etherd compensates for this by
byte swapping internally.
This version of rpc.etherd will report random garbage
statistics if invoked on a non-ethernet interface (e.g.
slip or loopback).
The implementation should use libcap(3) instead of re-
inventing the wheel for each platform.
AUTHOR
Originally written for Ultrix by Guy Cardwell, UC Irvine
Academic Computing, gcardwel@uci.edu
Ported to Linux, SunOS and BPF-using systems (notably
FreeBSD 2.x) by Stefan Petri <petri@ibr.cs.tu-bs.de>. The
machine-specific device handling code was taken from the
packet capture library libpcap(3).
5 October 1992 2
