Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to get the rate at which certain packets (i.e. LDAP) arrive on a interface in a linux environment.

I was thinking of using tcpdump to filter the wanted packets and subsequently monitor the rate at which rx packets are seen. Perhaps by monitoring the rate of writes/s to tcpdump output file?

Or perhaps even better iptables where i would match packets by certain rule and then somehow get the packet rate for packets matching this rule.

Any idea how this could be done?


share|improve this question

iptables is the right tool. You can create rules without a target. They just count packets then. And you can reset the counter of this rule (or at least of a chain).

You just have to decide whether you want to count new connections or really all packets and place the rule accordingly (usually an ACCEPT rule for packets with status ESTABLISHED is at the beginning of the rule set). You need the -v switch to see the packet and byte counters:

iptables -L -nv
share|improve this answer
Correct but iptables does not give you directly the rate. You need to call iptables -L -nv at N seconds interval and then divide the difference between the two measurements by N. – bortzmeyer Apr 19 '13 at 19:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.