I need to generate reports showing bandwidth usage broken down by port and protocol, based on all data sent/received over the last x days, in a fairly simple and secure way.

Storing full traffic dumps for later analysis is not an option here for privacy and resource reasons.

Being able to record these statistics in a simple way is important, because eventually I need to be able to combine these stats across all of the servers.

The target machines are running Debian, and minimal solutions would be better as many have below average specs. I have looked at nettop and it seemed like overkill, and I wasn't able to find the breakdown by port and protocol I needed.

Any advice would be greatly appreciated!


If you only need this to and from the Internet (or other WAN link), you'd do better to use something like NetFlow on the router (you'll need a collector), rather than run stats on each machine. That will show you port, protocol, and endpoint statistics quite nicely.

Now, if you do need to measure LAN traffic as well, that won't work for you.


ntop is useful, simple to setup overall accounting. It is based on libpcap to watch traffic but does not store the raw dumps. The traffic data is then available in RRD format if you want to poke around further than the information ntop provides. The web interface does let you drill down into a lot of information.

http://localhost:3000/sortDataIP.html will report per IP - total and protocols

http://localhost:3000/dump.html will let you export a "Hosts/Long" report in text, json, perl, php, python or xml that includes all those counters. Probably best to save that off at a specific time each day and calculate the difference from the saved copies.

  • I'm not sure where to begin trying to get this information about of ntop , this is what I meant I'd tried in the OP (not nettop). – YouCanCallMeBarry Jan 30 '13 at 8:44
  • Ah.. using 5.0.1? I just had a look at version 5 and it appears they've moved from simple /etc/services protocols and a -p option that let you define protocols to something called nDPI based on OpenDPI that doesn't detect any protocols for me via libpcap. Nice. I'll add the of where it should come from to the answer anyway – Matt Jan 30 '13 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.