Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server can I use lsof to find on a specific port the amount of traffic passed with servers? I used so far this in order to sort by highest size, but what info to i really get? how can I know with lsof (if possible) how many bytes where transfered with some other server in 1 hour for example or 1 minute?


lsof | sed 's/0t//' | grep  | awk '{print $7,$9}' | sort -nr | head -10

I used this to get the top 10 lsof with my port the size column is $7 $9 gives me the other party server name and port... (PS i'm using solaris)

share|improve this question
up vote 0 down vote accepted

If you want to find your throughput over time I would capture your packet headers(not the whole packet, requires lots of space) in non-promiscous mode to a file. This can be done with tcpdump or tshark(part of wireshark). You can then load your capture with wireshark and using the filters you can find your throughput for a service/port over a period of time. I believe you can also do some of the analysis with tshark on the command line which might help with scripting.

Basic capture on eth0:

tcpdump -p -i eth0 -w capture.pcap

Another option is ntop since it will do a lot of this for you in a web interface but I can't remember exactly how much detail you can get from it.

share|improve this answer
thanks and when i look at lsof at the size of files (i see it grows over time) is that also an indication for the traffic throughput? – Jas May 28 '11 at 4:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.