Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have several users on a computer running Linux (Ubuntu Lucid to be more specific).

I need to see how much network traffic they generate on a specific interface.

Iptables can match outgoing packages, so I could create chains for every user to be able to count outgoing network traffic. However, incoming traffic is significant too.

I have several options: -Writing a new iptables match for incoming packets -Writing a new iptables module that combines outgoing packet user match and connection tracking -Writing a TUN/TAP driver that somehow able to identify the sender / receiver process and user, and write a log -...

What is the best way to do this? Are there any existing solutions for this?

Thank you in advance.

share|improve this question

migrated from Oct 16 '10 at 3:30

This question came from our site for professional and enthusiast programmers.

I'm trying to compile a custom libc, but this might not be the best solution. – netom Oct 16 '10 at 9:56
up vote 2 down vote accepted

I managed to figure this out.

I wrote an LD_PRELOAD library that overrides send, recv, read, write family of functions and logs these operations on sockets.

The source code is very experimental and not secure, but anyway, I put it on SourceForge:

share|improve this answer
How you use the application ? – mezgani Mar 17 '14 at 21:09
I don't use or maintain that project anymore I'm sorry. – netom Mar 18 '14 at 12:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.