Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can anyone recommend a linux command line tool to monitor the number of bytes transferred between the local server and a specified IP address/port.

The equivalent tcpdump command would be:

tcpdump -s 0 -i any -w mycapture.trc port 80 host

which outputs :

46 packets captured
131 packets received by filter
0 packets dropped by kernel

I'd like something similar that outputs:

54 bytes out, 176 bytes in

I'd like it to work on RHEL and be free/open-source. It would be good if there was an existing tool which I was just missing too!

share|improve this question
up vote 10 down vote accepted

You could use iptables. If you're not already using it, you can use an open Accept configuration, but have a rule in place to do the counting.

For example, on RHEL your /etc/sysconfig/iptables file could look something like:

-A INPUT -s -p tcp -m tcp --sport 80 -j ACCEPT
-A OUTPUT -d -p tcp -m tcp --dport 80 -j ACCEPT

Where is the host:port you want to count traffic to (you can't use a hostname). You can then check traffic counted with the command iptables -nvxL as root.

Example output:

Chain INPUT (policy ACCEPT 7133268 packets, 1057227727 bytes)
    pkts      bytes target     prot opt in     out     source               destination     
 7133268 1057227727 ACCEPT     tcp  --  *      *                tcp spt:80

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination     
       0          0 INPUT      all  --  *      *         

Chain OUTPUT (policy ACCEPT 7133268 packets, 1057227727 bytes)
    pkts      bytes target     prot opt in     out     source               destination     
 7133268 1057227727 ACCEPT     tcp  --  *      *                tcp dpt:80
share|improve this answer
It's also completely legal to have a rule without a target, solely for counting purposes, eg iptables -A INPUT -d -p tcp --dport 3456 . It won't do anything to the traffic, as there's no "-j" argument, but each matching packet will bump the counts. – MadHatter Oct 28 '10 at 20:42
@MadHatter: Good tip, thanks – brent Oct 29 '10 at 14:54

There is also a tool called 'iftop' which displays bandwidth usage on an interface by host. I think iftop can do what you described but normally its interface is something like 'top'.

So for your example, I think that you can just create config file to provide your filter-code.

So here is my filter-code in my config file.

$ cat /tmp/conf
filter-code: port http and host

Then, I ran the following to see the network traffice.

$ sudo iftop -c /tmp/conf

Not sure if this is the best option but certainly one way to achieve what you need. HTH.

share|improve this answer
You can also specify the filter on the command line without using a config file: iftop -f 'port 80 and host' – gioele Jul 27 '15 at 14:27

I was about to suggest wireshark (for it's many 'conversation' features), but it is not a command-line tool. You could try tshark though, which is a command-line analyzer tool that is closes to wireshark. The output should have (somewhat) what you're looking for (example below):

tshark -R "ip.addr ==" -z conv,ip -p -f "tcp port 22"


                                     |       <-      | |       ->      | |     Total     |
                                     | Frames  Bytes | | Frames  Bytes | | Frames  Bytes |           <->        42     15341      35      4890      77     20231
share|improve this answer

You can also try "iptraf" it's lightweight and simple. It can filter by port and gives you high level info, no payload data, etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.