Is there any command like time that can record a process's network I/O stats and print them on exit?

Linux (and other *nix) has the time command that lets you record execution times - not just wall-clock time, but kernel and system CPU time, memory allocations, disk I/O activity and more. It's useful because it can be run as a simple command wrapper and tracks children too.


$ TIME="t=%E; I/O=%I:%O" time find $HOME > /dev/null
t=0:08.78; I/O=821408:0

but the network counters %r and %s only count send()/recv() calls; no TCP and no data volume. So they're not useful for network activity.

I've confirmed with

TIME="t=%E; I/O=%I:%O" time wget $somewebsite -O /dev/null

that socket read/write doesn't count for I/O and nor do dummy devices. Same for stdio. It only seems to track filesystem reads and writes.

But where can I get network stats?

I know I could use numerous tools like:

  • wireshark / tshark / tcpdump
  • ss / netstat
  • lsof
  • nethogs / iptraf / iftop / tcptrack
  • strace (slow, fine-grained)

but none of them make it simple to target just one process or process tree and record its total network activity over its lifetime.

I know it's possible to set socat up as a proxy. But that's also very awkward; it can't just run as a wrapper.

perf can do it, but it's very platform specific and can be fragile.

Surely there's something basic and commonplace out there that either:

  • intercepts network calls with LD_PRELOAD and collects stats on them; or
  • uses network namespaces (Linux) to collect all activity for the process group and measures that


  • 1
    It's a good question. There is no ready answer for network traffic, but bpftrace (Brendan Gregg) may offer the technology to create this. – Henk Langeveld Feb 1 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.