i like to run netstat -w 1 -b to watch the bytes. however, netstat
defaults to picking the last interface if you don't specify -I. on my
system, that happens to be pflog. not helpful.
the diff below makes some attempt at picking an interesting interface by
selecting the one with the most traffic.
Index: if.c
===================================================================
RCS file: /home/tedu/cvs/src/usr.bin/netstat/if.c,v
retrieving revision 1.62
diff -u -r1.62 if.c
--- if.c 22 Nov 2009 22:22:14 -0000 1.62
+++ if.c 8 Jan 2011 00:32:41 -0000
@@ -500,6 +500,7 @@
char *buf, *next, *lim;
char name[IFNAMSIZ];
size_t len;
+ int takeit = 0;
if (sysctl(mib, 6, NULL, &len, NULL, 0) == -1)
err(1, "sysctl");
@@ -508,6 +509,7 @@
if (sysctl(mib, 6, buf, &len, NULL, 0) == -1)
err(1, "sysctl");
+ memset(&ip_cur, 0, sizeof(ip_cur));
lim = buf + len;
for (next = buf; next < lim; next += rtm->rtm_msglen) {
rtm = (struct rt_msghdr *)next;
@@ -531,6 +533,14 @@
memcpy(name, sdl->sdl_data, sdl->sdl_nlen);
if (interface != NULL && !strcmp(name, interface)) {
+ takeit = 1;
+ } else if (interface == NULL &&
+ ifd->ifi_ibytes + ifd->ifi_obytes >=
+ ip_cur.ift_ib + ip_cur.ift_ob) {
+ takeit = 1;
+ } else
+ takeit = 0;
+ if (takeit) {
strlcpy(ip_cur.ift_name, name,
sizeof(ip_cur.ift_name));
ip_cur.ift_ip = ifd->ifi_ipackets;
@@ -554,19 +564,6 @@
sum_cur.ift_dr += 0; /* XXX ifnet.if_snd.ifq_drops */
break;
}
- }
- if (interface == NULL) {
- strlcpy(ip_cur.ift_name, name,
- sizeof(ip_cur.ift_name));
- ip_cur.ift_ip = ifd->ifi_ipackets;
- ip_cur.ift_ib = ifd->ifi_ibytes;
- ip_cur.ift_ie = ifd->ifi_ierrors;
- ip_cur.ift_op = ifd->ifi_opackets;
- ip_cur.ift_ob = ifd->ifi_obytes;
- ip_cur.ift_oe = ifd->ifi_oerrors;
- ip_cur.ift_co = ifd->ifi_collisions;
- ip_cur.ift_dr = 0;
- /* XXX ifnet.if_snd.ifq_drops */
}
free(buf);
}
