How to count inbound or outbound network connections on Linux

Question

I want to monitor the number of incoming and outgoing network connections. I can get the total number with netstat and wc -l, but I want to know how many are inbound and how many are outbound.

Answer 1

You can accomplish that by using ip_conntrack.

modprobe ip_conntrack
cat /proc/net/ip_conntrack

The established connections that have the source address equal to your interface's address are the outgoing connections.

The established connections that have the destination address equal to your interface's address, are the incoming connections.

# Number of outgoing connections
cat /proc/net/ip_conntrack | grep "ESTABLISHED" | grep "src=xxx.xxx.xxx.xxx" | wc -l

# Number of incoming connections
cat /proc/net/ip_conntrack | grep "ESTABLISHED" | grep "dst=xxx.xxx.xxx.xxx" | wc -l

(xxx.xxx.xxx.xxx is obviously your interface's ip address)

Keep in mind that there are connections that occur for inter-process communication, between applications running on your system.

You can find information about ip_conntrack entries here.

Answer 2

You can monitor all the incoming and outgoing connections with iftop.

http://www.ex-parrot.com/pdw/iftop/

If you want to get some statistics

http://www.ntop.org/products/ntop/