{"id":38714,"date":"2023-03-08T14:20:55","date_gmt":"2023-03-08T19:20:55","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=38714"},"modified":"2023-03-29T09:59:54","modified_gmt":"2023-03-29T13:59:54","slug":"macos-network-metrics-using-sysctl","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2023\/03\/08\/macos-network-metrics-using-sysctl\/","title":{"rendered":"macOS Network Metrics Using sysctl()"},"content":{"rendered":"<p><a href=\"https:\/\/milen.me\/writings\/macos-network-metrics-sysctl-net-rt-iflist2\/\">Milen Dzhumerov<\/a>:<\/p>\n<blockquote cite=\"https:\/\/milen.me\/writings\/macos-network-metrics-sysctl-net-rt-iflist2\/\"><p>As part of my work on the <a href=\"https:\/\/buck2.build\">Buck2 build system<\/a>, I needed a way to observe the network throughput of the system. After some research, the conclusion was to use <code>sysctl()<\/code> with <code>NET_RT_IFLIST2<\/code>: this provided access to 64bit metrics which do not suffer from overflowing that affects the 32bit fields of the older APIs.<\/p><p>[&#8230;]<\/p><p>If you looked at the traffic metrics, they would only ever increase in multiples of 1KiB. The reason for the behaviour is that <em>the kernel applies batching to prevent malicious code from fingerprinting the system<\/em>. This restriction applies <em>only<\/em> to 3rd party programs (i.e., not codesigned by Apple).<\/p><p>[&#8230;]<\/p><p>Upon further investigation, it became clear that the API truncates and wraps around the traffic metrics at the 4GiB mark. Again, this only affects 3rd party programs.<\/p><\/blockquote>\n\n<p id=\"macos-network-metrics-using-sysctl-update-2023-03-29\">Update (2023-03-29): <a href=\"https:\/\/twitter.com\/Mojo_66\/status\/1640756099308462080\">Mojo66<\/a>:<\/p>\n<blockquote cite=\"https:\/\/twitter.com\/Mojo_66\/status\/1640756099308462080\">\n<p>BTW, my currently-in-development Mac app &ldquo;DerPinger&rdquo; uses [<code>sysctl()<\/code>] to fetch 64-bit interface metrics, and does not have problems with 4GB wrapping on 13.2.1.<\/p>\n<p>I&rsquo;m looking for <a href=\"https:\/\/testflight.apple.com\/join\/KK5BOvi4\">beta testers<\/a>.<\/p>\n<\/blockquote>","protected":false},"excerpt":{"rendered":"<p>Milen Dzhumerov: As part of my work on the Buck2 build system, I needed a way to observe the network throughput of the system. After some research, the conclusion was to use sysctl() with NET_RT_IFLIST2: this provided access to 64bit metrics which do not suffer from overflowing that affects the 32bit fields of the older [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2023-03-08T19:21:01Z","apple_news_api_id":"249ac879-e640-4138-8121-31c0daf3ed2b","apple_news_api_modified_at":"2023-03-29T13:59:56Z","apple_news_api_revision":"AAAAAAAAAAAAAAAAAAAAAA==","apple_news_api_share_url":"https:\/\/apple.news\/AJJrIeeZAQTiBITHA2vPtKw","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[4],"tags":[575,1407,131,30,2223,476],"class_list":["post-38714","post","type-post","status-publish","format-standard","hentry","category-programming-category","tag-64-bit","tag-activity-monitor","tag-bug","tag-mac","tag-macos-13-ventura","tag-networking"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/38714","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=38714"}],"version-history":[{"count":2,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/38714\/revisions"}],"predecessor-version":[{"id":38899,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/38714\/revisions\/38899"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=38714"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=38714"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=38714"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}