Is it possible to count number of ICMP packets sent/received per interface in Linux?

Question

Is it possible to check statistics in Linux per interface for ICMP packets in particular? ifconfig command it provides statistics per interface for received and sent packets:

-> /sbin/ifconfig eth1
eth1      Link encap:Ethernet  HWaddr BC:30:5B:ED:DE:54  
          UP BROADCAST RUNNING SLAVE MULTICAST  MTU:1500  Metric:1
          RX packets:412327300 errors:0 dropped:0 overruns:0 frame:0
          TX packets:765211747 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:327931865613 (312740.1 Mb)  TX bytes:803392590272 (766174.8 Mb)
          Memory:dcc00000-dcd00000 

But what I am looking for, is some specific type of packets (like ICMP) per interface.

Also Linux is providing those statistics but globally in /proc/net/snmp:

-> cat /proc/net/snmp
... log truncated ...
Icmp: InMsgs InErrors InDestUnreachs InTimeExcds InParmProbs InSrcQuenchs InRedirects InEchos InEchoReps InTimestamps InTimestampReps InAddrMasks InAddrMaskReps OutMsgs OutErrors OutDestUnreachs OutTimeExcds OutParmProbs OutSrcQuenchs OutRedirects OutEchos OutEchoReps OutTimestamps OutTimestampReps OutAddrMasks OutAddrMaskReps
Icmp: 29697 5 276 9 0 0 0 29409 3 0 0 0 0 29970 0 561 0 0 0 0 5 29404 0 0 0 0
IcmpMsg: InType0 InType3 InType8 InType11 OutType0 OutType3 OutType8
IcmpMsg: 3 276 29409 9 29404 561 5
... log truncated ...

Or more pretty printing in with netstat -s command (-s stands for statistics of course):

-> netstat -s
... log truncated ...
Icmp:
    29697 ICMP messages received
    5 input ICMP message failed.
    ICMP input histogram:
        destination unreachable: 276
        timeout in transit: 9
        echo requests: 29409
        echo replies: 3
    29970 ICMP messages sent
    0 ICMP messages failed
    ICMP output histogram:
        destination unreachable: 561
        echo request: 5
        echo replies: 29404
IcmpMsg:
        InType0: 3
        InType3: 276
        InType8: 29409
        InType11: 9
        OutType0: 29404
        OutType3: 561
        OutType8: 5
... log truncated ...

So, the question is. is there any way to get ICMP statistics for some specific interface instead of global ICMP statistics for the whole system in Linux?

Answer 1

I don't think the kernel keeps counters for each protocol per interface. Taking a look into code which feeds /proc/net/netstat (among other things) we can find plenty of references to rtnl_link_stats64 which is defined in include/uapi/linux/if_link.h:

/* The main device statistics structure */
struct rtnl_link_stats64 {
        __u64   rx_packets;             /* total packets received       */
        __u64   tx_packets;             /* total packets transmitted    */
        __u64   rx_bytes;               /* total bytes received         */
        __u64   tx_bytes;               /* total bytes transmitted      */
        __u64   rx_errors;              /* bad packets received         */
        __u64   tx_errors;              /* packet transmit problems     */
        __u64   rx_dropped;             /* no space in linux buffers    */
        __u64   tx_dropped;             /* no space available in linux  */
        __u64   multicast;              /* multicast packets received   */
        __u64   collisions;

        /* detailed rx_errors: */
        __u64   rx_length_errors;
        __u64   rx_over_errors;         /* receiver ring buff overflow  */
        __u64   rx_crc_errors;          /* recved pkt with crc error    */
        __u64   rx_frame_errors;        /* recv'd frame alignment error */
        __u64   rx_fifo_errors;         /* recv'r fifo overrun          */
        __u64   rx_missed_errors;       /* receiver missed packet       */

        /* detailed tx_errors */
        __u64   tx_aborted_errors;
        __u64   tx_carrier_errors;
        __u64   tx_fifo_errors;
        __u64   tx_heartbeat_errors;
        __u64   tx_window_errors;

        /* for cslip etc */
        __u64   rx_compressed;
        __u64   tx_compressed;
};

If I got it right this is the structure in which per-link (or per-interface which comes semantically being the same thing in this case) statistics are kept and there don't seem to be protocol specific counters.

Answer 2

Looking at the implementation itself when it increases the counters and it seems Linux is not providing these stats per interface for specific protocols as you mention:

struct icmp_mib icmp_statistics;

...

static void icmp_out_count(int type)

{

        if(type>18)

               return;

        (*icmp_pointers[type].output)++;

        icmp_statistics.IcmpOutMsgs++;

}

...

int icmp_rcv(struct sk_buff *skb, struct device *dev, struct options *opt,

         __u32 daddr, unsigned short len,

         __u32 saddr, int redo, struct inet_protocol *protocol)

{
...
icmp_statistics.IcmpInMsgs++;
        if(len < sizeof(struct icmphdr))

        {

               icmp_statistics.IcmpInErrors++;
        ...
        }
...
}

And so on. So it seems general statistics for all interfaces, never mention specific interfaces.