Home / server / Questions / 500864
In Process
vobelic
Asked: 2013-04-20 01:18:10 +0800 CST

Getting packet rate with tcpdump or iptables

  • 772

I need to get the rate at which certain packets (i.e. LDAP) arrive on a interface in a linux environment.

I was thinking of using tcpdump to filter the wanted packets and subsequently monitor the rate at which rx packets are seen. Perhaps by monitoring the rate of writes/s to tcpdump output file?

Or perhaps even better iptables where i would match packets by certain rule and then somehow get the packet rate for packets matching this rule.

Any idea how this could be done?

Thanks!

iptables

1 Answers

  1. iptables is the right tool. You can create rules without a target. They just count packets then. And you can reset the counter of this rule (or at least of a chain).

    You just have to decide whether you want to count new connections or really all packets and place the rule accordingly (usually an ACCEPT rule for packets with status ESTABLISHED is at the beginning of the rule set). You need the -v switch to see the packet and byte counters:

    iptables -L -nv
    • 1