Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Ubuntu server and I am interested in measuring how much data is being transferred (both in and out) across a network interface, by a specific user. How do I do it?

N.B. I know how to measure the total data transfer of the whole machine. I want to restrict my monitoring to a specific user.

share|improve this question
up vote 3 down vote accepted

You can use iptables rules to do this. Here are some commands that would keep track of all traffic for a user with UID=1000

iptables -I OUTPUT -m owner --uid-owner 1000 -j CONNMARK --set-mark 1
iptables -I INPUT -m mark --mark 1
iptables -I INPUT -j CONNMARK --restore-mark

You can then view the counters with iptables -nvL. The number of bytes is the second field.
For input traffic you'll want to look at the line under INPUT that has mark match 0x1 on the end. For output traffic it'll be the line with CONNMARK set 0x1 on the end.


iptables -I OUTPUT -m owner --uid-owner 1000 -j CONNMARK --set-mark 1

This tells iptables to set firewall mark 1 on all outbound traffic from user with uid=1000.

iptables -I INPUT -j CONNMARK --restore-mark

This tells iptables to use connection tracking to figure out which incoming packets are associated with the outgoing packets, and restore any firewall marks for the stream (ie, the ones that we set the mark on above).

iptables -I INPUT -m mark --mark 1

This tells iptables to match any incoming packets that have firewall mark 1. We dont do anything with them, we just use it so it'll increment the counters.

share|improve this answer
I remembered a way to get iptables to keep track of inbound traffic as well. Answer has been adjusted. – Patrick Jan 11 '12 at 13:30
Looks good... how does it handle incoming packets that are not associated with outgoing packets, e.g. incoming HTTP requests to a web server? – jl6 Jan 13 '12 at 22:48
It cant, not initially. For incoming connections, when it passes through iptables, it doesnt know what user is going to get it yet. However when the reply goes back out it'll know what user it came from which will mark that connection from then on. So it'll miss the first packet, which is really small anyway since its just a tcp syn packet to start the connection – Patrick Jan 13 '12 at 23:57

The only way you can really accomplish that is to write your own System Tap script. I did something similar for Zabbix monitoring. The script at the link does not keep track of data per user, but it shows the basic concept.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.