Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server can I use lsof to find on a specific port the amount of traffic passed with servers? I used so far this in order to sort by highest size, but what info to i really get? how can I know with lsof (if possible) how many bytes where transfered with some other server in 1 hour for example or 1 minute?


lsof | sed 's/0t//' | grep  | awk '{print $7,$9}' | sort -nr | head -10

I used this to get the top 10 lsof with my port the size column is $7 $9 gives me the other party server name and port... (PS i'm using solaris)

share|improve this question
up vote 0 down vote accepted

If you want to find your throughput over time I would capture your packet headers(not the whole packet, requires lots of space) in non-promiscous mode to a file. This can be done with tcpdump or tshark(part of wireshark). You can then load your capture with wireshark and using the filters you can find your throughput for a service/port over a period of time. I believe you can also do some of the analysis with tshark on the command line which might help with scripting.

Basic capture on eth0:

tcpdump -p -i eth0 -w capture.pcap

Another option is ntop since it will do a lot of this for you in a web interface but I can't remember exactly how much detail you can get from it.

share|improve this answer
thanks and when i look at lsof at the size of files (i see it grows over time) is that also an indication for the traffic throughput? – Jas May 28 '11 at 4:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .