Sstrhsrtj

I have a service which can only handle a max of 10 requests per second and I need to monitor how often this is exceeded. I have seen various solutions with tcpdump, ss, netstat, ntop but none seem to give what I need. I guess the monitoring would need to be split into two scripts. One collecting the data via tcpdump running as root e.g:

tcpdump -i eth0 src ldapproxy and port ldap and '(tcp-syn|tcp-ack)!=0'

and then another script to analyse the output and give a max queries per second since the last check and this is the bit where I am stuck.

Here's some awk to get you started:

awk '/ > /{

  split($1,t,":"); time = (t[1]*60+t[2])*60+t[3]

  diff = time-lasttime; lasttime = time

  event[++i] = diff; window += diff; tod[i] = $1

  while(window>=1){

    window -= event[1]

    for(j=1;j<i;j++){

        event[j] = event[j+1]

        tod[j] = tod[j+1]

    }

    i--

  }

  if(i+1>10) printf "%d events in %f secs at %sn",i+1,window,tod[i]

} '

It keeps (in array event) all the timestamps (converted to float seconds) which are in a running window of 1 second. When the window is exceeded by a new event, the 1st recorded event is removed and all the events shifted down one. i says how many events there are, not counting the one corresponding to the start of the window, which is always at relative time zero. The script prints how many events were in the window when the number exceeds 10. Example output:

11 events in 0.962827 secs at 14:53:51.262827

The pattern / > / is to match only incoming packets. You may need to refine this to match the lines that interest you.