[TriLUG] Reset conuters on eth interface

[Jon Carnes]

I think we tried to hunt this one down a couple of years ago and at that
time we came up blank.  The only way to reset those values was to
reboot. Starting and stopping the network does not clear the stats.

The stats are stored in /proc/net/dev. You can read this file, but not
write to it.  

I wrote some packages to watch my firewalls and they recorded the number
of packets per hour to cross in and out of the machine.  For that I
simply stored the hourly numbers and subtracted one hours numbers from
the last hours numbers.  That worked fine.

IPChains will let you record the same information, and reset it's
counter whenever you like. If its necessary to you to have something
that you can reset to zero, then turn on your accounting in IPChains (or
IPTables).

Jon
===

On Tue, 2002-09-10 at 08:32, Jeff Bollinger wrote:
> Does anyone know how to reset the counters on a particular ethernet 
> interface?  For example,
> 
> ifconfig eth1
> eth1      Link encap:Ethernet  HWaddr 00:04:75:B0:07:14
>            BROADCAST MULTICAST  MTU:1500  Metric:1
>            RX packets:7664356 errors:0 dropped:0 overruns:1 frame:0
>            TX packets:6424 errors:0 dropped:0 overruns:0 carrier:0
>            collisions:0 txqueuelen:100
>            RX bytes:1089057890 (1038.6 Mb)  TX bytes:405296 (395.7 Kb)
>            Interrupt:9 Base address:0x7880
> 
> How can I zero out the "RX bytes" and the "TX bytes" portions above?
> 
> Thanks,
> Jeff
> 
> -- 
> Jeff Bollinger
> University of North Carolina
> IT Security Analyst
> 105 Abernethy Hall
> mailto: jeff_bollinger at unc dot edu
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.6 (GNU/Linux)
> Comment: For info see http://www.gnupg.org
> 
> iEYEARECAAYFAjzETQsACgkQvoVlxVBmgsXunQCg1Pjc14nTjWiP8FCy+NNDK97E
> HMAAoIRhikBeM5Lm+6Iu/0h3MX6lDgiR
> =LpiV
> -----END PGP SIGNATURE-----
> 
> _______________________________________________
> TriLUG mailing list
>     http://www.trilug.org/mailman/listinfo/trilug
> TriLUG Organizational FAQ:
>     http://www.trilug.org/~lovelace/faq/TriLUG-faq.html