psutil.net_connections() - see connections by interface?

[erik.fl...@gmail.com]

Hi,

Once again, splendid work with psutil!

I have one question... Would it be possible to count network connections by network interface somehow?

My issue is that when using psutil.net_connections(), it shows the local address. However, i've encounter several cases where network interfaces actually shares the same local ip-address. I assume this is bridging behind this somehow.

Would it be possible that this function also returns the actual interface (eth0, eth1, wlan0 etc) the connection belongs to?

[Giampaolo Rodola']

Hello and thanks. :-)

No, unfortunately what you ask is not possible. Sockets have no notion of routing in that sense.

What you could do is get a list of all source addresses as in:

>>> local_addrs = [x.laddr[0] for x in psutil.net_connections()]

>>> local_addrs

['0.0.0.0', '0.0.0.0', '192.168.1.6', '192.168.33.1', '::', '127.0.0.1', '192.168.1.6', '192.168.1.6', '192.168.1.6', '::', '192.168.33.1', '0.0.0.0', '192.168.1.6', '::', '192.168.1.6', '0.0.0.0', '0.0.0.0', '192.168.1.6', '192.168.1.6', '0.0.0.0', '::', '192.168.1.6', '192.168.1.6', '::', '0.0.0.0', '192.168.0.131', '192.168.1.6', '192.168.1.6', '192.168.1.6', '0.0.0.0', '192.168.1.6', '0.0.0.0', '192.168.0.131', '0.0.0.0', '192.168.0.131', '192.168.1.6', '192.168.1.6', '192.168.1.6', '192.168.1.6', '192.168.33.1', '192.168.1.6', '0.0.0.0', '::', '192.168.1.6', '0.0.0.0', '::', '192.168.0.131', '0.0.0.0', '192.168.1.6', '192.168.1.6', '::', '::', '127.0.0.1', '192.168.1.6', '0.0.0.0', '127.0.0.1', '192.168.1.6', '192.168.1.6', '0.0.0.0', '0.0.0.0', '192.168.1.6', '::', '192.168.1.6', '192.168.1.6', '192.168.1.6', '192.168.0.131', '192.168.1.6', '192.168.1.6', '192.168.1.6', '127.0.1.1', '127.0.1.1', '192.168.1.6', '192.168.1.6', '192.168.1.6', '192.168.1.6', '192.168.1.6', '::', '192.168.1.6', '::', '192.168.50.1', '192.168.1.6', '0.0.0.0', '::', '192.168.1.6', '192.168.1.6', '192.168.1.6', '0.0.0.0', '192.168.1.6', '192.168.1.6', '192.168.1.6', '192.168.1.6', '192.168.1.6', '0.0.0.0', '::', '0.0.0.0', '192.168.1.6', '192.168.1.6', '::', '0.0.0.0', '192.168.1.6', '192.168.1.6', '192.168.1.6', '192.168.50.1', '192.168.1.6', '192.168.33.1', '::', '::', '192.168.1.6', '192.168.1.6', '192.168.1.6', '192.168.1.6', '0.0.0.0', '192.168.1.6', '::', '0.0.0.0', '192.168.1.6', '192.168.1.6', '192.168.0.131', '::', '192.168.0.131', '192.168.1.6', '192.168.1.6', '192.168.1.6', '0.0.0.0']

...and then with those somehow figure out what the NIC those connections are referring to may be.

Considering we can get a list of NIC names + associated addresses with psutil.net_if_addrs() I came up with this.

It works for IPv4 connections only and it probably is not reliable but here goes. 

import psutil

import socket

from collections import defaultdict

def get_addrs_map():

    addrs_map = defaultdict(list)

    for nic, addrs in psutil.net_if_addrs().items():

        for addr in addrs:

            if addr.family == socket.AF_INET:

                first3octs = '.'.join(addr.address.split('.')[:3])

                addrs_map[first3octs].append(nic)

    return addrs_map

ret = defaultdict(int)

addrs_map = get_addrs_map()

local_addrs = [x.laddr[0] for x in psutil.net_connections(kind='inet4')]

for addr in local_addrs:

    first3octs = '.'.join(addr.split('.')[:3])

    try:

        nics = addrs_map[first3octs]

    except KeyError:

        ret['unknown'] += 1

    else:

        for nic in nics:

            ret[nic] += 1

print dict(ret)

On my machine it prints:

{'wlp3s0': 71, 'vboxnet0': 2, 'vboxnet1': 4, 'lo': 3}

....so *in my case* it proved to be reliable but again, it's a hack. 

--
You received this message because you are subscribed to the "Python process utilities (psutil)" project group:
http://code.google.com/p/psutil
To post to this group, send email to psu...@googlegroups.com
To unsubscribe from this group, send email to psutil-unsubscribe@googlegroups.com
For more options, visit this group at http://groups.google.com/group/psutil
---
You received this message because you are subscribed to the Google Groups "psutil" group.
To unsubscribe from this group and stop receiving emails from it, send an email to psutil+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Giampaolo - http://grodola.blogspot.com

[erik.fl...@gmail.com]

Hi,

Matching a connection with a local address seems reasonable, but I cannot see why you put "local_addrs" into the mix considering we can get the local assigned ip for each interface from psutil.net_if_addrs() ?

[Giampaolo Rodola']

Well, if you want to count the number of connections per NIC you necessarily need to get all connections (net_connections()), then figure out what NIC they refer to via net_if_addrs().

--

You received this message because you are subscribed to the "Python process utilities (psutil)" project group:
http://code.google.com/p/psutil
To post to this group, send email to psu...@googlegroups.com
To unsubscribe from this group, send email to psutil-unsubscribe@googlegroups.com
For more options, visit this group at http://groups.google.com/group/psutil
---
You received this message because you are subscribed to the Google Groups "psutil" group.
To unsubscribe from this group and stop receiving emails from it, send an email to psutil+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[erik.fl...@gmail.com]

Hi,

Yes, that was my idea in general.

Thanks for your input!

Den tisdag 25 oktober 2016 kl. 22:24:15 UTC+2 skrev erik.fl...@gmail.com:

[Giampaolo Rodola']

On top of what I said above, you may have listening sockets whose source address is "0.0.0.0", which is an alias for "listen to all NICs". Of course you won't have a NIC with that IP address assigned so you may decide to skip those addresses (because they are not connected).

--

You received this message because you are subscribed to the "Python process utilities (psutil)" project group:
http://code.google.com/p/psutil
To post to this group, send email to psu...@googlegroups.com
To unsubscribe from this group, send email to psutil-unsubscribe@googlegroups.com
For more options, visit this group at http://groups.google.com/group/psutil
---
You received this message because you are subscribed to the Google Groups "psutil" group.
To unsubscribe from this group and stop receiving emails from it, send an email to psutil+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[erik.fl...@gmail.com]

Hi,

My solution ended up something like this:

net_types = ['ESTABLISHED','TIME_WAIT','CLOSE_WAIT']

net_connections = psutil.net_connections('inet')

for nic, addrs in psutil.net_if_addrs().items():

connections[nic] = {}

connections[nic]['net_conn_established'] = 0

connections[nic]['net_conn_time_wait'] = 0

connections[nic]['net_conn_close_wait'] = 0

for addr in addrs:

for net_row in net_connections:

if net_row.status in net_types:

net_row_laddr = "%s:%s" % (net_row.laddr)

net_row_laddr = net_row_laddr.rsplit(':', 1)[0]

if net_row_laddr == addr.address:

if net_row.status == "ESTABLISHED":

connections[nic]['net_conn_established'] += 1

if net_row.status == "TIME_WAIT":

connections[nic]['net_conn_time_wait'] += 1

if net_row.status == "CLOSE_WAIT":

connections[nic]['net_conn_close_wait'] += 1

Probably not the prettiest code, but it seems to do the trick. What I want it to do is to simply count the different TCP-connections on each interface.

What do you think, it should be correct right?

Den fredag 28 oktober 2016 kl. 11:59:11 UTC+2 skrev Giampaolo Rodola':

On top of what I said above, you may have listening sockets whose source address is "0.0.0.0", which is an alias for "listen to all NICs". Of course you won't have a NIC with that IP address assigned so you may decide to skip those addresses (because they are not connected).

On Fri, Oct 28, 2016 at 8:21 AM, <erik.fl...@gmail.com> wrote:

Hi,

Yes, that was my idea in general.

Thanks for your input!

Den tisdag 25 oktober 2016 kl. 22:24:15 UTC+2 skrev erik.fl...@gmail.com:

Hi,

Once again, splendid work with psutil!

I have one question... Would it be possible to count network connections by network interface somehow?

My issue is that when using psutil.net_connections(), it shows the local address. However, i've encounter several cases where network interfaces actually shares the same local ip-address. I assume this is bridging behind this somehow.

Would it be possible that this function also returns the actual interface (eth0, eth1, wlan0 etc) the connection belongs to?

--
You received this message because you are subscribed to the "Python process utilities (psutil)" project group:
http://code.google.com/p/psutil
To post to this group, send email to psu...@googlegroups.com

To unsubscribe from this group, send email to psutil-un...@googlegroups.com

For more options, visit this group at http://groups.google.com/group/psutil
---
You received this message because you are subscribed to the Google Groups "psutil" group.

To unsubscribe from this group and stop receiving emails from it, send an email to psutil+un...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Giampaolo Rodola']

Yep, on a first glance it appears it should work.

To unsubscribe from this group, send email to psutil-unsubscribe@googlegroups.com

For more options, visit this group at http://groups.google.com/group/psutil
---
You received this message because you are subscribed to the Google Groups "psutil" group.

To unsubscribe from this group and stop receiving emails from it, send an email to psutil+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.