Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way with Ubuntu 10.4LTS to detect and aggregate the number of packets transmitted over every port?

In other words, I'd like a process to keep track of the number of packets sent to each TCP port (whether or not a connection is established), and aggregate the number of packets, generating output like this:

22: 2535
67: 12424
6135: 1
6136: 1
6137: 1
11211: 244

It wouldn't hurt if the program kept track of other information, such as the packet flags (TCP SYN, connect, ACK, etc.), ideally by percentage.

I'm not aware of any program to do this seemingly fairly simple accounting, but I assume there is one. I'd be grateful for any information about what programs can provide this information.

Thank you for reading.


share|improve this question

You can use iptables to account for these. For example:

iptables -A INPUT -p TCP --dport 80 --syn

will count the number of incoming SYN packets to port 80.

If you want to keep track of detailed statistics for a given period of time, I'd recommend using tcpdump to grab everything and then running multiple passes over the data with different filters.

You may also be interested in ntop.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.