monitoring bytes processed off network interface in user space

[marty <martyleisner@yahoo.com>]

I want to be able to see if user space is processing network traffic
(as opposed to raw rx/tx packets on the interface).  

Is there a way to track this?  (beyond modifying all the applications which
deal with the network).  I need to track traffic to/from userspace to a 
"specific" interface, not things like localhost.

Note, this is an embedded system talking  (at times) appletalk,novell, ipv4, ipv6 and maybe other things...

Currently we have something like

while(1) {
     WOL packet
     timeout on no activity on rx/tx counts and then go sleep
}

Unfortunatley, rx/tx activity won't solve the problem on a busy lan with lots of broadcast packets.   If our WOL filter will only wake us on (lets say) on directed TCP/UDP packets, a constant ping will prevent us from going back to sleep...

If there isn't a way to do this, it may be simple to add some counters
in the right places in the network stacks (instead of packets, it would be bytes).

marty

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com