From: grahn+nntp@snipabacken.se   
      
   On Thu, 2010-09-30, Rick Jones wrote:   
   > Jorgen Grahn  wrote:   
   >> On Wed, 2010-09-29, Rick Jones wrote:   
   >> > And/or check the netstat stats from before and after to see if   
   >> > they report receipt of IP datagram fragments.   
   >   
   >> Yes, except if there's lots of activity or the counters are huge   
   >> already, it can be hard to see what changed.   
   >   
   >>     That just gave me an idea: it's possible to write a semi-general   
   >>     Unix utility which you run as e.g. "cmd_diff netstat -s" which   
   >>     runs netstat -s, but shows you the difference between now and   
   >>     last time you ran it. If the only difference it sees is in   
   >>     numbers, it can display the numeric delta, otherwise a normal   
   >>     diff(1).   
   >   
   >>     Wonder why I never thought of it before. I have spent lots of   
   >>     time doing that procedure manually (for various tools) in the   
   >>     past.   
   >   
   > Well, with a setup like that, how can I resist :) A former co-worker   
   > of mine wrote a little utility called "beforeafter"   
   > (ftp://ftp.cup.hp.com/dist/networking/tools) which will do just that:   
   >   
   > netstat -s > before   
   >    
   > netstat -s > after   
   > beforeafter before after > delta   
      
   Ah, thanks!  Good ideas are rarely new.   
      
   > Any number beforeafter finds in "after" will have the corresponding   
   > number in "before" subtracted from it.  I find it works pretty well.   
   > It *may* get tripped-up by some of the Linux "don't show the stat   
   > unless it is non-zero" behaviour (*) though if a stat appears in   
   > "after" that was not in "before."  An opportunity for someone to   
   > "value add" to beforeafter I suppose :)   
   >   
   > rick jones   
   >   
   > (*) never really have liked that sort of behaviour - sure, it shortens   
   > the output but it complicates parsing...not impossibly so, but   
   > certainly inconveniently so.   
      
   I count at least four different line formats in the output of 'netstat   
   -s' on my machine, in different parts of the output.  It's a mess.   
   Not even very readable for humans, either.   
      
   /Jorgen   
      
   --   
     // Jorgen Grahn    O  o   .   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)