Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to get a table updated with the exchanged bytes (Rx and/or Tx) for each ESTABLISHED TCP connection on a linux machine (well, at least, a list of connections (port ranges), thus not actually all)

My dream would be to extend 'netstat' and have these counters as additional columns. But where to find these infos? Maybe this is available in the kernel ? /proc? *nix tool? Should I stick to libpcap?

Hints: What I CAN'T do is to start a tcpdump for each connections. What I WOULD avoid is having to run this something as root (well, sudo can be discussed)

Thank you for all your inputs...

share|improve this question

I would recommend IPTABLES counter, you can show packet counter for each rule in iptables using

iptables -nL -v

the option -v here shows you the packet and byte count.

The only catch is you need to have a matching rule ( -j ACCEPT ) for each connection entry.

For example below rule counts all TCP packets generated from my linux box.

iptables -A OUTPUT -p tcp -j ACCEPT

Now I only need to run

iptables -nL -v

to see the bytes and packet count used.

share|improve this answer
Sweet! this is totally new input...I could use it, again it is only in 'root' mode but could lead to something, I'll give it a try (of course 'iptables -A OUPUT -p tcp -j ACCEPT' won't make it on my box, since i do not have any chain/target/match by that name, right?) – blietaer Apr 4 '11 at 9:54
My bad, should be iptables -A OUTPUT -p tcp -j ACCEPT – Bharat Apr 4 '11 at 11:00

If you want something fancy and graphical you might take a look at ntop - it's in most distro's apt / yum / whatever.

It monitors the network traffic creating nice graphs and charts on a per-connection, protocol, host, etc basis and displays it all through your web browser (has a built in web server).

It's nice, but fairly heavyweight.

share|improve this answer
That is indeed very valuable input as it is a complete product and clearly reproduce the output I want to see, just like: but again, this is libpcap oriented and I have to be root (and indeed fairly heavyweight) – blietaer Apr 4 '11 at 9:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .