Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a server can I use lsof to find on a specific port the amount of traffic passed with servers? I used so far this in order to sort by highest size, but what info to i really get? how can I know with lsof (if possible) how many bytes where transfered with some other server in 1 hour for example or 1 minute?

thanks

lsof | sed 's/0t//' | grep  | awk '{print $7,$9}' | sort -nr | head -10

I used this to get the top 10 lsof with my port the size column is $7 $9 gives me the other party server name and port... (PS i'm using solaris)

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

If you want to find your throughput over time I would capture your packet headers(not the whole packet, requires lots of space) in non-promiscous mode to a file. This can be done with tcpdump or tshark(part of wireshark). You can then load your capture with wireshark and using the filters you can find your throughput for a service/port over a period of time. I believe you can also do some of the analysis with tshark on the command line which might help with scripting.

Basic capture on eth0:

tcpdump -p -i eth0 -w capture.pcap

Another option is ntop since it will do a lot of this for you in a web interface but I can't remember exactly how much detail you can get from it.

share|improve this answer
    
thanks and when i look at lsof at the size of files (i see it grows over time) is that also an indication for the traffic throughput? –  Jas May 28 '11 at 4:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.