3

I have rhel4 and rhel6 hosts.

I can use netstat -s to see information on the number of segments sent/received. I can use ifconfig to see the number of bytes sent/received on a given interface (for my purposes only one is important, the rest have total transmission 3 orders of magnitude less).

How can I find the total number of bytes transmitted via TCP?

Edit: I do not have root access on the hosts in question.

1
  • If you just want the data on an interface and not just tcp then maybe vnstat might be helpful for you since it can monitor an interface without being root.
    – Jason Zhu
    Feb 12, 2014 at 21:51

1 Answer 1

1

Define a packet filter rule with iptables to count all tcp packets.

Count all incoming packets with tcp protocol:

# iptables -I INPUT -p tcp

Count all outgoing packets with tcp protocol:

# iptables -I OUTPUT -p tcp

Show iptables rules including packet counts for incoming packets:

# iptables -nvL INPUT

Show iptables rules including packet counts for outgoing packets:

# iptables -nvL OUTPUT

iptables -nvL shows the packet count and the byte count in the first two columns. The two defined rules will be the first ones on the top of the list. If you have a lot of iptables rules, an extra chain could be helpful:

# iptables -N count_in              # create custom chain named 'count_in'
# iptables -A count_in -j RETURN    # append RETURN action to chain 'count_in'
# iptables -I INPUT -j count_in     # insert chain at the top of chain INPUT
# iptables -I count_in 1 -p tcp     # insert rule that matches all tcp packets
                                    # and has no action (does nothing)
# iptables -nvL count_in            # list chain 'count_in' rules

Do the same for the outgoing packets with a custom chain count_out.

3
  • Unfortunately I do not have root access on these hosts. I have clarified the question, thanks for your response though!
    – JRG
    Feb 12, 2014 at 19:53
  • It looks like this is the only way, so I'm giving the check
    – JRG
    Feb 15, 2014 at 14:54
  • I think there must be made provisions as root like the iptables rules above or the installation of packages like an snmp daemon to get accurate results and make the data available for users. Which also makes sense from a security aspect. You can get some information without root using nstat -a but only for IP.
    – rda
    Feb 17, 2014 at 12:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .