2

Is it possible with tcpdump to count (for some set up time) the number of outgoing and incoming UDP packets?

I don't have much experience in tcpdump, so an advice how to do that would be very helpful. I read that a timeout commend is good if I want to stop a process after some given time, so I was thinking about just stopping tcpdump after my time.

But how I can count the number of outgoing and incoming packets and filter only UDP packets?

2

I wouldn't use tcpdump (or tshark) for this. Instead I'd use iptables to count the packets over a period of time

# Prepare two sets of counters and set up the rules
#
iptables -N udp_in
iptables -N udp_out
iptables -A udp_in
iptables -A udp_out

iptables -A OUTPUT --protocol udp -j udp_out
iptables -A INPUT --protocol udp -j udp_in

You can reset the counters at the start of your period like this

# Reset the counters
#
iptables -Z udp_in
iptables -Z udp_out

You can read the counters at the end of your period like this

# Look at the counters
#
packets_in=$(iptables -nvL udp_in | awk '/all/{print $1}')
packets_out=$(iptables -nvL udp_out | awk '/all/{print $1}')
echo "in=$packets_in, out=$packets_out"

You can read a counter and immediately reset it by providing the Z flag at the same time. For example

packets_in=$(iptables -nvLZ udp_in | awk '/all/{print $1}')

Putting bits together, and assuming you've already created the necessary extra iptables chains (see above), you can use something like this

# Reset the counters
#
iptables -Z udp_in
iptables -Z udp_out

# Wait 10 seconds
#
period=10
sleep "$period"

# Look at the counters
#
packets_in=$(iptables -nvL udp_in | awk '/all/{print $1}')
packets_out=$(iptables -nvL udp_out | awk '/all/{print $1}')

# Report the results
#
echo "During the last $period seconds we saw $packets_in UDP packet(s) in and $packets_out UDP packet(s) out."
3
  • Could you add why you would use iptables over tcpdump? There seems to be a lot more setup work (vs a relatively straigtforward setup for timeout/tcpdump) so I'm wondering what the benefits of your method are. I'm not saying my answer is better by any means. ;-) – MikeA Nov 3 '16 at 16:15
  • @MikeA neither method is wrong, and both will deliver the results. I have used iptables in this fashion before - to count packets and bytes through an interface over consecutive 24 hour periods. In that scenario I don't even need the sleep; instead I can use a daily cron entry. I'm aware that tcpdump and tshark can count packets but I don't know how accurate that is in combination with the interrupt triggered with timeout. It might be perfect, or it might drop the last "few"; I simply don't know. – roaima Nov 3 '16 at 22:12
  • Good point and interesting approach. – MikeA Nov 3 '16 at 22:42
1

man tcpdump provides the information you need. The tcpdump web page also provides a manpage.

Right in the DESCRIPTION it says that when tcpdump finished capturing packets, it reports counts of packets captured, received by filter, and dropped by kernel.

Filtering (which is how you only look for packets of a certain type) can be much more difficult, but the EXAMPLES section should give enough of a clue that the only filter you need is udp for your example.

So, once you've figured out the correct filter, use tcpdump with timeout which will run it for your defined time, kill tcpdump, and you will get the count of packets.

timeout 20 tcpdump udp

This will run tcpdump filtering for udp and will kill tcpdump after 20 seconds.

1
  • Probably worth mentioning that it should be run with -p to avoid the overhead of promiscuous mode. – roaima Nov 3 '16 at 22:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.