Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two machines with two applications that talk to each other on few network ports (TCP and UDP). I want to count traffic that they send and receive. I need not only overall count but stats per machine per port per day. I tried darkstat, but it doesn't provide stats per day, but only overall counters.

Is there other way that I can count that traffic (I can put some proxy or gateway between that two machines).

share|improve this question
up vote 9 down vote accepted

iptables can give you statistics about how many each rule was triggered, so you can add LOG rules on the ports of interest (lets say port 20 & port 80):

iptables -A INPUT -p tcp --dport 22
iptables -A INPUT -p tcp --dport 80

and then

iptables -n -L -v

will give you number of packets and bytes sent through this ports. Of course you will have to parse from the output the ports that interests you.

If you need exact values, add an -x:

iptables -n -L -v -x
share|improve this answer
No need to put LOG rules (which will flood your log files), just count the number of times a rule gets triggered. – Gilles Jun 27 '12 at 23:19
Indeed. A rule doesn't need to have an action. A useful lesson to learn: rules without -J are good for accounting. – Alexios Jun 28 '12 at 19:17

You can add accounting rules to your iptables configuration. These should occur before you accept ESTABLISHED and RELATED traffic or you will miss counting traffic that passes. To count web traffic try a rule like:

iptables -A INPUT -p tcp --dport 80 

If you have a bunch of them you may want to create an accounting chain so you can report and zero counters on it in isolation from other chains.

The Shorewall firewall allows you to easily add accounting rules to your rule set.

share|improve this answer

It's not clear whether you need usage per destination IP, but vnstat is a useful tool for recording traffic usage per interface. Install it and then run vnstat -u -i eth0 for each interface you want to monitor. To then get the usage per day use vnstat -i eth0 -d.

share|improve this answer
I don't think that using vnstat I can get stat per port... Or am I wrong? – pbm Jun 29 '12 at 19:27
@pbm Ah, you mean TCP/UDP port. No, vnstat won't do that. – mgorven Jun 29 '12 at 20:49

Utilize the tcpdump,

tcpdump -i any -nnn

the outputs of the above command would include the timestamp, src/dest ip addresses, port and the packet length. With those information, you can achieve your goal easily by a well written script.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.