Section 7.11. ICMP Statistics

7.11. ICMP Statistics

ICMP statistics are maintained by Solaris in the same way as TCP and IP, as explained in the previous two sections. To avoid unnecessary repetition, we list only key points and differences in this section.

The MIB-II statistics are in /etc/sma/snmp/mibs/IP-MIB.txt and in RFC 2011, along with IP. Solaris has a few additions to the ICMP MIB.

7.11.1. ICMP Statistics from Kstat

The following command prints all of the ICMP MIB statistics.

$ kstat -n icmp module: ip                              instance: 0 name:   icmp                            class:    mib2         crtime                          3.207830752         inAddrMaskReps                  0         inAddrMasks                     0 ... 

7.11.2. ICMP Statistics Reference

Table 7.4 from mib2.h lists ICMP MIB-II statistics plus Solaris additions.

Table 7.4. ICMP Kstat/MIB-II Statistics

Statistic	Description
icmpInMsgs	Total # of received ICMP messages
icmpInErrors	# of received ICMP messages msgs with errors
icmpInDestUnreachs	# of received "dest unreachable" messages
icmpInTimeExcds	# of received "time exceeded" messages
icmpInParmProbs	# of received "parameter problem" messages
icmpInSrcQuenchs	# of received "source quench" messages
icmpInRedirects	# of received "ICMP redirect" messages
icmpInEchos	# of received "echo request" messages
icmpInEchoReps	# of received "echo reply" messages
icmpInTimestamps	# of received "timestamp" messages
icmpInTimestampReps	# of received "timestamp reply" messages
icmpInAddrMasks	# of received "address mask request" messages
icmpInAddrMaskReps	# of received "address mask reply" messages
icmpOutMsgs	total # of sent ICMP messages
icmpOutErrors	# of messages not sent for internal ICMP errors
icmpOutDestUnreachs	# of "dest unreachable" messages sent
icmpOutTimeExcds	# of "time exceeded" messages sent
icmpOutParmProbs	# of "parameter problem" messages sent
icmpOutSrcQuenchs	# of "source quench" messages sent
icmpOutRedirects	# of "ICMP redirect" messages sent
icmpOutEchos	# of "Echo request" messages sent
icmpOutEchoReps	# of "Echo reply" messages sent
icmpOutTimestamps	# of "timestamp request" messages sent
icmpOutTimestampReps	# of "timestamp reply" messages sent
icmpOutAddrMasks	# of "address mask request" messages sent
icmpOutAddrMaskReps	# of "address mask reply" messages sent
...	/* In addition to MIB-II */
icmpInCksumErrs	# of received packets with checksum errors
icmpInUnknowns	# of received packets with unknown codes
icmpInFragNeeded	# of received unreachables with "fragmentation needed"
icmpOutFragNeeded	# of sent unreachables with "fragmentation needed"
icmpOutDrops	# of messages not sent since original packet was broadcast/multicast or an ICMP error packet
icmpInOverflows	# of ICMP packets dropped because of queue overflow
icmpInBadRedirects	# of received "ICMP redirect" messages that are bad and thus ignored

7.11.3. ICMP Statistics from DTrace

The following DTrace one-liner tracks ICMP MIB events.

# dtrace -n 'mib:::icmp* { @[probename] = sum(arg0); }' dtrace: description 'mib:::icmp* ' matched 34 probes ^C   icmpInEchoReps                                                    1   icmpInEchos                                                       3   icmpOutEchoReps                                                   3   icmpOutMsgs                                                       3   icmpInMsgs                                                        4 

7.11.4. Tracing Raw Network Functions

The fbt provider traces raw kernel functions, but its use is not recommended, because kernel functions may change between minor releases of Solaris, breaking DTrace scripts that used them. On the other hand, being able to trace these events is certainly better than not having the option at all.

The following example counts the frequency of TCP/IP functions called for this demonstration.

# dtrace -n 'fbt:ip::entry { @[probefunc] = count(); }' dtrace: description 'fbt:ip::entry ' matched 1757 probes ^C ...   ip_cksum                                                        519   tcp_wput_data                                                  3058   tcp_output                                                     3165   tcp_wput                                                       3195   squeue_enter                                                   3203 

This one-liner matched 1, 757 probes for this build of Solaris 10 (the number of matches will vary for other builds). Another line of attack is the network driver itself. Here we demonstrate hme.

#  dtrace -n 'fbt:hme::entry { @[probefunc] = count(); }' dtrace: description 'fbt:hme::entry '  matched 100 probes ^C ...   hmewput                                                         221   hmeintr                                                         320   hme_check_dma_handle                                            668   hme_check_acc_handle                                            762 

The 100 probes provided by this hme driver may be sufficient for the task at hand and are easier to use than 1, 757 probes. rtls provides even fewer probes, 33.