TCP probes and message size

TCP probes and message size

[Matthew Ward]

I'm currently implementing a tcp.recvmsg probe as a form of bandwidth 
tracking against IP addresses on a KVM guest (as we have lots of IP 
addresses pointing to it) and I'm a bit confused as to what the size 
represents in terms of HTTP requests and wondered if someone could offer 
some advice as to the more complicated workings of systemtap and TCP 
that I lack knowledge in :-)

My probe is as follows:

probe tcp.recvmsg {
   net_recv[saddr,daddr] <<< size
}

In every case, the source address and destination address are the same. 
A single request for a 789B (excluding HTTP headers) HTML page from the 
server (served using Apache through an httpd.worker process) requested 
using curl results in 3 probe requests; 2 for 1 httpd.worker process for 
8512B and 1 for another httpd.worker process for 16384B.

What I basically want to know is, why does a single HTTP request for 
789B of data result in 3 probes for tcp.recvmsg that results in 24896B 
of data transfer recorded? Is there some way to drill down better in to 
this TCP data that systemtap exposes that will give the exact amount of 
data sent to the client?

Thanks for any help that any one can give!

-- 
Matthew Ward
Web and Mobile Application Developer
Fubra Limited

w: www.fubra.com
e: matthew.ward@fubra.com

------------------------------

Fubra is a company limited by shares and registered in England and
Wales with number 3967214 at Anstey Park House, Anstey Road,
Alton, Hampshire, GU34 2RL. We are registered for VAT with number
GB733667024, and as a data controller with number Z5193400.
We are members of RIPE, Nominet, The Italian RA and registered
with OfCom as a provider of electronic communications services.