I have a Linux box which works as a router.

How can I measure which connections send and receive how much data?

For each hour, I would like something like:

src_addr   src_port  dst_addr         dst_port  proto  packets  bytes   34567  443       tcp    101      150 KiB   53          53        udp    21       11 KiB   45678  443       tcp    452      220 KiB   56789  25        tcp    105      50 KiB   53          53        udp    20       10 KiB

but with thousands of rows.

Ideally this would be written straight into a database, but an hourly import from a .csv would be fine.

Are there any existing efficient Linux tools which will give me this data, aggregated by the hour?

Or do I need to build my own with C and libpcap?


iftop is a good solution to report connections. Many other exist as well : iptraf-ng, nethog, bmon...

According to Alexandre that explained how to use iftop and output text, your solution is to put

iftop -t -s 3600 > log-(date +\%Y\%m\%d\%H\%M\%S).txt

in your crontab every hour.

  • This only lists the connections which were most active in the last 40 seconds of the hour, which is not very useful. – fadedbee Jun 11 '20 at 16:36

I like vnstat (also on GitHub). I think it does all the things you've asked about - at least it's configurable, and actively maintained.

I use it because it doesn't consume many resources, and I've better things to do with compute cycles on my small systems.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.