netstat for number of packets received by process IDs

Question

I use the simple netstat command "netstat -nltp" which shows me all active TCP connections along with the PID and process name. However even after playing around with parameters, I am unabe to get an important information from the command.

That is:

I want to see the number of packets received and sent from/to this PID I learnt that Recv-Q and Send-Q are not indicative of this. Also, the statistics parameter seems to sum up for all processes. How can I see the packets received and sent to a PID?

Thanks

Alexander Yancharuk · Answer 1 · 2019-07-06T05:47:00.150

3

Use inner process counters for that:

cat /proc/<PID>/net/netstat

edited Jul 06 '19 at 05:47

answered Jul 05 '19 at 14:09

Alexander Yancharuk

13,817
5
55
55

Unfortunately, I need it for all "active" processes. – tweet Jul 05 '19 at 14:23

score 1 · Answer 2 · answered Jul 05 '19 at 14:03

1

You want to do network traffic accounting per process.

There are number of applications that allow you to do that in real-time (i.e: nethogs), but the problem is keeping traffic counters over time.

I would suggest you to do so using iptables, assuming you can clearly distinguish your processes using a network port.

This article is still OK for your use case: https://www.cyberciti.biz/faq/linux-configuring-ip-traffic-accounting/

PS: This sort of questions is best in Server Fault

answered Jul 05 '19 at 14:03

Alexandre Juma

3,128
1
20
46

Thanks but does iptables show process name/PID info as well? – tweet Jul 05 '19 at 14:22
No, I stated that I am assuming you can clearly identify your processes based on network port. I suggest iptables because you can have persisted accounting counters across process restart, for example. – Alexandre Juma Jul 05 '19 at 14:30
You can easily map ports to PIDs using lsof or netstat – Alexandre Juma Jul 05 '19 at 14:31

netstat for number of packets received by process IDs

2 Answers2