Home / server / Questions / 1023720
Accepted
xrfang
Asked: 2020-07-03 01:29:19 +0800 CST

use nethogs in a script

  • 772

nethogs is a great utility to monitor network traffic by process. However, it is "interactive" and not suitable to be used in script... How can I achieve the following using nethogs or similar tool:

I want to monitor a process (by its id or name) for a few second, get its traffic (as a number, in any unit such as KB/s), if the traffic is lower than a threshold, the script returns non-zero.

Thanks a lot.

EDIT:

  1. Debian 10 Server
  2. The program I need to monitor is ffmpeg, which push RTSP stream to remote RTMP server. i.e. it is a "client", not "server".
  3. If possible I'd like to avoid iptables. Also, since there are many instance of ffmpeg running, find out traffice for each and every instance is vital. I don't know if iptables can trace process or not??
linux networking monitoring

2 Answers

  1. If your processes are listening, like servers (HTTP/HTTPS/SSH), you need know what ports processes are binding to then you can iptables accounting rules.

    You didn't say what operating system your using, but this script should be fairly adaptable.

    ### create a new set of chains ###
 /sbin/iptables -N INET_IN_PORT
 /sbin/iptables -N INET_OUT_PORT

### ATTACH them to the INPUT and OUTPUT Chains ###
 /sbin/iptables -A INPUT -j INET_IN_PORT
 /sbin/iptables -A OUTPUT -j INET_OUT_PORT

### Set up rules for INPUT ###
 /sbin/iptables -A INET_IN_PORT -i eth0 -p tcp --dport 80
 /sbin/iptables -A INET_IN_PORT -i eth0 -p tcp --dport 443
 /sbin/iptables -A INET_IN_PORT -i eth0 -p tcp --dport 22

### Set up rules for OUTPUT ###
 /sbin/iptables -A INET_OUT_PORT -o eth0 -p tcp --sport 80
 /sbin/iptables -A INET_OUT_PORT -o eth0 -p tcp --sport 443
 /sbin/iptables -A INET_OUT_PORT -o eth0 -p tcp --sport 22

    This will monitor ports 80,443,22 incoming and outgoing.

    you can put the following in your script to show the counters.

    iptables -L INET_IN_PORT -v -n

    iptables -L INET_OUT_PORT -v -n

    $ iptables -L INET_IN_PORT -v -x

    Chain INET_IN_PORT (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0            tcp  --  eth0   any     anywhere             anywhere             tcp dpt:http
       0        0            tcp  --  eth0   any     anywhere             anywhere             tcp dpt:https
     198    15497            tcp  --  eth0   any     anywhere             anywhere             tcp dpt:ssh

    You may want to reset the counters when you've queried them. Thus if you query them every two seconds you can check if the exceed a value you define.

    iptables -L INET_IN_PORT -Z

    iptables -L INET_OUT_PORT -Z

    This should give you enough for basis for a script to exactly what you need.

    if your processes use dynamics ports on each load, then query what ports they are using and configure iptables accordingly.

    I hope this helps, good luck!

    • 0
  2. Best Answer

    I found that nethogs has some command line options, especially -t (trace mode), which is suitable for use in scripts:

    nethogs -s -t -c 5 eno1 2>/dev/null|grep ffmpeg

    This will count all traffic on the eno1 interface for 5 seconds, then quit.

    • 0