lsof get traffic size with server

Question

I have a server can I use lsof to find on a specific port the amount of traffic passed with servers? I used so far this in order to sort by highest size, but what info to i really get? how can I know with lsof (if possible) how many bytes where transfered with some other server in 1 hour for example or 1 minute?

thanks

lsof | sed 's/0t//' | grep  | awk '{print $7,$9}' | sort -nr | head -10

I used this to get the top 10 lsof with my port the size column is $7 $9 gives me the other party server name and port... (PS i'm using solaris)

Answer 1

If you want to find your throughput over time I would capture your packet headers(not the whole packet, requires lots of space) in non-promiscous mode to a file. This can be done with tcpdump or tshark(part of wireshark). You can then load your capture with wireshark and using the filters you can find your throughput for a service/port over a period of time. I believe you can also do some of the analysis with tshark on the command line which might help with scripting.

Basic capture on eth0:

tcpdump -p -i eth0 -w capture.pcap

Another option is ntop since it will do a lot of this for you in a web interface but I can't remember exactly how much detail you can get from it.