I have an embedded Linux/Busybox system that needs to monitor its own network connectivity. I'm trying to figure out if the device is "all alone" on the network for more than say 10 minutes, and take corrective action if it is. The system may be in a physically inaccessible location.

I'm mostly looking for a general solution to detect gross failures, e.g. the system is getting zero network traffic. Our server can monitor specific ports on its own.

The rootfs is rapidly approaching its maximum size of 16MB, so many common applications are not an option, e.g. nmap or tcpdump would put us over the 16MB limit.

Here are my ideas:

  • Some entry in /proc/net might indicate the time of the last TCP or UDP packet
  • Find any random peer on the network and try to ping them (is anybody out there listening???)
  • Monitor /sys/class/net/eth0/rx_packets to see if the number is increasing

What is going to be most reliable?

  • Hm. Monitor rx_packets, if it's not increasing (because there's no traffic to your node), put eth0 in promiscious mode and see if there's traffic at all (not coming from your node)? This still might not work if your node is connected to a smart switch/router that doesn't let you see packets not meant for you. WLAN is easier. – dirkt Oct 25 '16 at 6:54

Your latter 2 ideas are both good. (Your first idea comes down to pretty much the same thing as your third idea.) The question is whether you need to do active or passive monitoring.

The point against passive monitoring is that lack of traffic might be normal some of the time simply because, for example, there are no clients actively using the services provided by your box. If you can assume based on your use case that this shouldn't happen, then passive monitoring will be fine.

The point against active monitoring is that you will falsely declare a failure if the specific external resource you chose to monitor is actually down (i.e. the problem is on the other end). You can mitigate this by actively monitoring more than one external resource and react only if they all become unreachable at the same time.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.