I have a server can I use lsof to find on a specific port the amount of traffic passed with servers? I used so far this in order to sort by highest size, but what info to i really get? how can I know with lsof (if possible) how many bytes where transfered with some other server in 1 hour for example or 1 minute?


lsof | sed 's/0t//' | grep  | awk '{print $7,$9}' | sort -nr | head -10

I used this to get the top 10 lsof with my port the size column is $7 $9 gives me the other party server name and port... (PS i'm using solaris)


If you want to find your throughput over time I would capture your packet headers(not the whole packet, requires lots of space) in non-promiscous mode to a file. This can be done with tcpdump or tshark(part of wireshark). You can then load your capture with wireshark and using the filters you can find your throughput for a service/port over a period of time. I believe you can also do some of the analysis with tshark on the command line which might help with scripting.

Basic capture on eth0:

tcpdump -p -i eth0 -w capture.pcap

Another option is ntop since it will do a lot of this for you in a web interface but I can't remember exactly how much detail you can get from it.

  • thanks and when i look at lsof at the size of files (i see it grows over time) is that also an indication for the traffic throughput? – Jas May 28 '11 at 4:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.