[PLUG] Logging network use while using Zoom

[TomasK]

netstat is normally the program to interpret/parse this.
If you do not mind column-izing it - I suggest the number in OutOctets
(53,633,193) columns should tell you how many bites went out and
inOctets  (75,040,712) how many bytes came in. If I counted the columns
right.

As always Google is your friend If you cannot guess some of the less
obvious metrics. This is also reasonably well documented in kernel.

Hope that helps, Tomas

On Wed, 2021-05-12 at 21:01 -0700, Dick Steffens wrote:
> On 5/11/21 2:17 PM, TomasK wrote:
> > 1. start web browser with single tab - your zoom/whatever only
> > 2. find web browsers pid (ps -ef |grep firefox)
> > 3. Do you conference
> > call - Do not exit after the call ends
> > 4. Check network usage for the process in: /proc/pid/net/netstat
> > 5. now you can quit firefox
> 
> I followed those instructions and got some "results". Now I need to 
> learn how to interpret them. Those results are:
> 
> steff at richard-ThinkPad-X200-Tablet:~$ cat /proc/2176/net/netstat
> TcpExt: SyncookiesSent SyncookiesRecv SyncookiesFailed EmbryonicRsts 
> PruneCalled RcvPruned OfoPruned OutOfWindowIcmps LockDroppedIcmps 
> ArpFilter TW TWRecycled TWKilled PAWSActive PAWSEstab DelayedACKs 
> DelayedACKLocked DelayedACKLost ListenOverflows ListenDrops
> TCPHPHits 
> TCPPureAcks TCPHPAcks TCPRenoRecovery TCPSackRecovery
> TCPSACKReneging 
> TCPSACKReorder TCPRenoReorder TCPTSReorder TCPFullUndo
> TCPPartialUndo 
> TCPDSACKUndo TCPLossUndo TCPLostRetransmit TCPRenoFailures 
> TCPSackFailures TCPLossFailures TCPFastRetrans TCPSlowStartRetrans 
> TCPTimeouts TCPLossProbes TCPLossProbeRecovery TCPRenoRecoveryFail 
> TCPSackRecoveryFail TCPRcvCollapsed TCPBacklogCoalesce
> TCPDSACKOldSent 
> TCPDSACKOfoSent TCPDSACKRecv TCPDSACKOfoRecv TCPAbortOnData 
> TCPAbortOnClose TCPAbortOnMemory TCPAbortOnTimeout TCPAbortOnLinger 
> TCPAbortFailed TCPMemoryPressures TCPMemoryPressuresChrono 
> TCPSACKDiscard TCPDSACKIgnoredOld TCPDSACKIgnoredNoUndo
> TCPSpuriousRTOs 
> TCPMD5NotFound TCPMD5Unexpected TCPMD5Failure TCPSackShifted 
> TCPSackMerged TCPSackShiftFallback TCPBacklogDrop PFMemallocDrop 
> TCPMinTTLDrop TCPDeferAcceptDrop IPReversePathFilter
> TCPTimeWaitOverflow 
> TCPReqQFullDoCookies TCPReqQFullDrop TCPRetransFail TCPRcvCoalesce 
> TCPOFOQueue TCPOFODrop TCPOFOMerge TCPChallengeACK TCPSYNChallenge 
> TCPFastOpenActive TCPFastOpenActiveFail TCPFastOpenPassive 
> TCPFastOpenPassiveFail TCPFastOpenListenOverflow
> TCPFastOpenCookieReqd 
> TCPFastOpenBlackhole TCPSpuriousRtxHostQueues BusyPollRxPackets 
> TCPAutoCorking TCPFromZeroWindowAdv TCPToZeroWindowAdv 
> TCPWantZeroWindowAdv TCPSynRetrans TCPOrigDataSent
> TCPHystartTrainDetect 
> TCPHystartTrainCwnd TCPHystartDelayDetect TCPHystartDelayCwnd 
> TCPACKSkippedSynRecv TCPACKSkippedPAWS TCPACKSkippedSeq 
> TCPACKSkippedFinWait2 TCPACKSkippedTimeWait TCPACKSkippedChallenge 
> TCPWinProbe TCPKeepAlive TCPMTUPFail TCPMTUPSuccess TCPDelivered 
> TCPDeliveredCE TCPAckCompressed TCPZeroWindowDrop TCPRcvQDrop 
> TCPWqueueTooBig TCPFastOpenPassiveAltKey
> TcpExt: 0 0 0 0 0 0 0 0 0 0 21 0 0 0 0 707 1 723 0 0 6579 816 7325 0
> 9 0 
> 22 0 0 4 0 1 0 0 0 0 0 10 0 0 194 1 0 0 0 3 723 0 194 0 24 2 0 0 0 0
> 0 0 
> 0 0 72 0 0 0 0 0 1 42 0 0 0 0 0 0 0 0 0 1348 127 0 0 29 29 0 0 0 0 0
> 0 0 
> 0 0 345 0 0 25 0 8583 0 0 0 0 0 0 0 0 0 0 0 224 0 0 8804 0 40 0 0 0 0
> IpExt: InNoRoutes InTruncatedPkts InMcastPkts OutMcastPkts
> InBcastPkts 
> OutBcastPkts InOctets OutOctets InMcastOctets OutMcastOctets 
> InBcastOctets OutBcastOctets InCsumErrors InNoECTPkts InECT1Pkts 
> InECT0Pkts InCEPkts ReasmOverlaps
> IpExt: 0 0 1209 236 945 1 75040712 53633193 145887 18870 143154 65 0 
> 424771 0 0 0 0
> rsteff at richard-ThinkPad-X200-Tablet:~$
> 
> As I'm looking at it I'm wondering if this was the right program to
> be 
> tracking. When I start up a Zoom session, it's the Zoom program that 
> runs. I can actually shut down Firefox at that point. The only thing
> I 
> need Firefox for is the link for the meeting.
> 
> So, is there anything in the above set of stuff that is a count of
> bytes 
> exchanged?
>