Using RHEL/CentOS 6.7 -- I want to be be able to know byte counts on IPv4 ports. We have thousands.. I would think counting via IP Tables for that would be a bit unweldy and slow the firewall a wee bit. I guess Linux does not keep a running total of the bytes/port in /proc somewhere.

I've been looking at ss, netstat, iptraf and netlink. They don't give me what I'm looking for... is this information already available or am I going to have to setup firewall counters?


Is this interactive? I use iptraf for this.

iptraf screenshot


    # yum install iptraf
  • No; it would not be interactive. The bytes it counts; are when you start the program -- I would want a running total of bytes per day by port. – Ziferius Mar 17 '16 at 22:21
  • then try iptraf -B -s eth0 -t 1 -L /root/test.log – nicocesar Mar 25 '16 at 19:11
  • I've looked at that. But this would be running 24/7 -- iptraf logs the data and potentially slows things down like tcpdump does by putting the interface in promiscuous mode. – Ziferius Mar 25 '16 at 23:50

Iptables by default (in my experience) counts packets matched against its rules, you don't need to setup this up.
By default this is reset when you reboot, but I believe you can setup something up to remember the count.
Because this is happening anyway I can't see how you are going to be "slowing down the firewall", you are only querying iptables for information that has already been obtained.

To view iptables current packet / byte count:

[sudo] iptables -nvL | grep -v '0    0'


  • -n - dont do DNS lookups
  • -L - list rules - by default shows all chains (on filter table)
  • -v - this is what gives the matching info and byte counts

By default the nvL command shows all the rules that are defined even if there are 0 counts of matches, so the grep -v just removes these lines.

If you want something a little more "in real time" you can wrap the command in a watch statement

watch "[sudo] iptables -nvL | grep -v '0    0'"
  • 1
    I understand -- but I'd have to create rules by port. So I have 350 integrations, each one is using a different port to communicate. So to get a tally of bytes that each port would be a separate firewall rule. – Ziferius Mar 17 '16 at 22:23
  • @Ziferius ok I see. so you are saying you dont have rules that explicitly ACCEPT legitimate traffic? what I mean is, wouldn't you have a policy that DROP's everything - and only ACCEPT what you want - so I would have thought you would have those rules anyway? if not you might be able to build an AWK script which reads iptables packet counts and aggregates per port - or if creating per port rules is an option and the port numbering has some "regular" system - use a script to assign the rules...? – the_velour_fog Mar 17 '16 at 22:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.