I'm writing a script that parses the output of
lsof to show a list of what processes have sockets open (similar to what
lsof also gives me a file descriptor. What I want to do now is have my script also tell how much data (in KB/sec) is being sent/received through that socket.
So far I've looked at:
nethogs: Tells me a process's network I/O, but only per process, not per socket.
iotop: Tells me disk I/O per process; doesn't appear to be able to tell network I/O nor I/O per socket.
/proc/pid/fd/: Doesn't look like this can tell me much at all.
fatrace: Tells me what files (not sockets) a process accesses.
iostat: Tells me average I/O stats per disk.
tcpdump: Gives me a dump of all traffic per IP; doesn't appear to be able to tell which socket the traffic belongs to.
strace -p pid -e trace=network -s 0: Tells me every time the given process calls certain socket functions, which seems useful, but in practice is only giving me a lot of
recvfrom(13, 0x7feed8fb3074, 4096, 0, 0, 0) = -1 EAGAIN (Resource temporarily unavailable)
strace -p pid -e trace=read,write -s: Tells me the result of each
strace looks promising, but I'm not sure I'm working it correctly (is
read,write enough?), plus it seems like there would be a lot of overhead. (For every process with an open socket I'd have to run an instance of
strace and parse the output.)
Does the Linux kernel provide a nicer means to measure how much I/O is going on per fd/socket? Possibly something could be set up with
iptables or hacking on