Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For a testing setup I have, I need to monitor the throughput through a "router"* at regular intervals of around 5 seconds or less (sub-second intervals would be very nice, but not required). Ideally, I would be able to generate a file which contained both the number of bytes and packets seen during each interval. I will eventually be generating a time-series of throughput from this data.

On a previous setup using an older version of FreeBSD, there was a tool called "bpfmon" which gave me this information. However, I need to do this under a modern version of Linux (namely, Ubuntu 11.04).

I have looked at both iptraf and iftop, but these do not appear to provide the resolution I need, nor do they seem to easily allow scraping the data I need. I understand iptables statistics may be able to give me what I'm after, but the examples I've seen of this seem to rely on repeatedly reading and resetting traffic counters, which seems like it could give inaccurate as read/reset is not an atomic operation. I already capture a tcpdump trace of the traffic I'm interested in on the link I want to monitor, so I am open to approaches which simply parse that.

I feel like this must be a common problem though, so I am hoping there will be a standard "best practice" tool for accomplishing this.

*I say "router" in quotes because I am really talking about a machine with two bridged NICs through which all the traffic I'm interested in passes.

share|improve this question
up vote 3 down vote accepted

All approaches will finally result in a repeated counter read operation. Typically, you would not reset the counters (just for the reason you mentioned - you might lose count due to a race condition) but compare the values collected with the ones from the previous sample.

But since you are already using tcpdump to save your connection data, you could use something like tcptrace in graphing mode to get your data visualized.

And if you simply quickly need some throughput / number of packets data, you could simply use tcpstat 1

share|improve this answer
tcpstat was exactly what I was looking for, thanks! – Shaddi Jun 25 '11 at 13:01

Why don't you try again with iptraf? Go to the Configure/Timers.../Screen update interval... menu and enter 1 (for 1 second sampling frequency). BTW, if the NICs are bridged it would not be called a "router". It would be a bridge or perhaps a switch.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.