Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two Linux machines that keep pinging each other. With each ping request they attach a data packet in the response. The frequency of the pings can not be determined.

How do I determine how many GB's of data they transfer to each other via the Network ?

share|improve this question

Assuming you have root access to s Linux machine somewhere on the path (either endpoint, or even a router in between), you can write an iptables rule that matches the application traffic and directs it to a particular chain that does nothing but accept all packets. The kernel maintains a byte and packet counter on each chain. Assuming the packets you want to count go from IP TCP port 42123 to IP TCP port 42789:

iptables -I FORWARD -p tcp -s --sport 42123 -d --dport 42789 -j ACCEPT

Replace FORWARD by OUTPUT on the source host, by INPUT on the destination host. You can read the counters with iptables -nvxL FORWARD 42 where 42 is the number of the rules (the first rule is number 1).

Do this for each direction if you want to count both directions. Read the counters at known time intervals to measure bandwidth usage.

You can gain a little flexibility if you create an intermediate chain.

iptables -N myapp_counter
iptables -A myapp_counter -j ACCEPT
iptables -I FORWARD -p tcp -s --sport 42123 -d --dport 42789 -j myapp_counter
iptables -I FORWARD -p tcp -s --sport 42789 -d --dport 42123 -j myapp_counter

With this setup, the counter for the myapp_counter will include traffic in both directions. Another benefit of going through a chain is that you can atomically read the counter on the chain and set it to 0 with iptables -nvxZL myapp_counter. And you don't need to figure out the rule number, so it's easier to automate the setup.

share|improve this answer
It also may be beneficial to zero the counters when you list them (-Z with -L) so you don't have to remember the last counter value and perform a subtraction. Combining -Z with -L will atomically give you the current value and zero the counter. – camh Nov 29 '10 at 23:46
@camh: Good point, but that only works for a chain. Is it possible to atomically read and set the counter on a rule? – Gilles Nov 30 '10 at 0:13
According to my iptables(8) man page: iptables [-t table] {-F|-L|-Z} [chain [rulenum]] [options...] - that is you can specify a rule number and zero just a single rule. I have iptables v1.4.10 installed. – camh Nov 30 '10 at 0:25
@camh: Ah, that's new in iptables 1.4.6. Before that, -Z only works on a chain, not on an individual rule. – Gilles Nov 30 '10 at 1:09

you can see statistics with ifconfig.

share|improve this answer

You can check which program is using data with nethogs (http://nethogs.sourceforge.net/).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.