Count exchanged bytes per TCP connection

Question

I need to get a table updated with the exchanged bytes (Rx and/or Tx) for each ESTABLISHED TCP connection on a linux machine (well, at least, a list of connections (port ranges), thus not actually all)

My dream would be to extend 'netstat' and have these counters as additional columns. But where to find these infos? Maybe this is available in the kernel ? /proc? *nix tool? Should I stick to libpcap?

Hints: What I CAN'T do is to start a tcpdump for each connections. What I WOULD avoid is having to run this something as root (well, sudo can be discussed)

Thank you for all your inputs...

Answer 1

I would recommend IPTABLES counter, you can show packet counter for each rule in iptables using

iptables -nL -v

the option -v here shows you the packet and byte count.

The only catch is you need to have a matching rule ( -j ACCEPT ) for each connection entry.

For example below rule counts all TCP packets generated from my linux box.

iptables -A OUTPUT -p tcp -j ACCEPT

Now I only need to run

iptables -nL -v

to see the bytes and packet count used.

Answer 2

If you want something fancy and graphical you might take a look at ntop - it's in most distro's apt / yum / whatever.

It monitors the network traffic creating nice graphs and charts on a per-connection, protocol, host, etc basis and displays it all through your web browser (has a built in web server).

It's nice, but fairly heavyweight.