banshee/linux-collection/linux/snmp/tcp

TCP connections of a Linux host, by SNMP

Returns the number of established TCP connections. Two watches are offered, with no default threshold.

How it works

The collector reads tcpCurrEstab (TCP-MIB): the connections in the ESTABLISHED or CLOSE-WAIT state, at the moment of the run.

Prerequisites

snmpd (net-snmp) running on the host, listening on an address the poller reaches (UDP 161), with the firewall open to the poller only.
The view granted to the poller includes the tcp group (.1.3.6.1.2.1.6).
Read-only access, SNMPv2c or SNMPv3, set on the host or one of its folders (protocol:snmp:* variables).

# /etc/snmp/snmpd.conf
agentaddress udp:161
view   banshee included .1.3.6.1.2.1.6.9
rocommunity <community> 192.0.2.10 -V banshee
# or: rouser <user> priv -V banshee

Outputs

Name	Label	Unit
`established`	Established TCP connections

Watches

Watch	Kind	Defaults	Checked
Too many TCP connections	Above a threshold, on `established`	no threshold	no
Unusual number of connections	Unusual value, on `established`	normal sensitivity	no

Limits

What is normal depends on the server's role: neither watch has a default threshold.
Connections in other states (TIME-WAIT, SYN-RECV) are not counted: a flood of half-open connections is not seen.