Dave Gantose <gantose@grc.nasa.gov> wrote on Tue, 10 Jul 2001
at 15:40:17 +0106 in <200107101939.PAA26416@lombok-fi.lerc.nasa.gov>:

> > If your software is running as root, you could look up the amount of
> > outstanding data in the tcpcb (kernel grovelling).
> 
> That sounds like what I originally wanted to do. How do I do it?

Very carefully.

At the high-level, you walk the list of tcp protocol control blocks
in the kernel, find the one for your connection, and then you can
take (snd_nxt-snd_una). 

You should also look at how netstat -f inet gets the "Send Q" number,
which is from the socket buffer, I believe. Also, code inspection
of netstat should give you an idea of how to read the tcpcb. See
"netstat -P <address>" to dump that stuff for a given tcp connection
(get the address from netstat -A -f inet).

In fact, I guess, for proof-of-concept, you could just run netstat
instead of kernel grovelling. But I expect that would be too slow.


Also, beware that these numbers cannot be read atomically, so
be prepared to sanity check and for them to change out from
under you.

--jhawk