From: rick.jones2@hp.com   
      
   Jorgen Grahn  wrote:   
   > On Wed, 2010-09-29, Rick Jones wrote:   
   > > And/or check the netstat stats from before and after to see if   
   > > they report receipt of IP datagram fragments.   
      
   > Yes, except if there's lots of activity or the counters are huge   
   > already, it can be hard to see what changed.   
      
   >     That just gave me an idea: it's possible to write a semi-general   
   >     Unix utility which you run as e.g. "cmd_diff netstat -s" which   
   >     runs netstat -s, but shows you the difference between now and   
   >     last time you ran it. If the only difference it sees is in   
   >     numbers, it can display the numeric delta, otherwise a normal   
   >     diff(1).   
      
   >     Wonder why I never thought of it before. I have spent lots of   
   >     time doing that procedure manually (for various tools) in the   
   >     past.   
      
   Well, with a setup like that, how can I resist :) A former co-worker   
   of mine wrote a little utility called "beforeafter"   
   (ftp://ftp.cup.hp.com/dist/networking/tools) which will do just that:   
      
   netstat -s > before   
      
   netstat -s > after   
   beforeafter before after > delta   
      
   Any number beforeafter finds in "after" will have the corresponding   
   number in "before" subtracted from it.  I find it works pretty well.   
   It *may* get tripped-up by some of the Linux "don't show the stat   
   unless it is non-zero" behaviour (*) though if a stat appears in   
   "after" that was not in "before."  An opportunity for someone to   
   "value add" to beforeafter I suppose :)   
      
   rick jones   
      
   (*) never really have liked that sort of behaviour - sure, it shortens   
   the output but it complicates parsing...not impossibly so, but   
   certainly inconveniently so.   
      
   --   
   web2.0 n, the dot.com reunion tour...   
   these opinions are mine, all mine; HP might not want them anyway... :)   
   feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)