On Sat, Jan 28, 2006 at 11:47:26AM -0700, Ross Werner wrote: > On Sat, 28 Jan 2006, Justin Findlay wrote: > >I agree. In vain I've searched for a utility that will tell me > >network usage per process on the local machine rather than per network > >connection. Inline on top would be perfect. Perhaps that's the > >charge given unto us, Ross. We need to write such a utility. > > I'm up for the challenge ... but is it even possible to get such > information? Ethereal and the like just listen on a network device for > packets going in and out, but the network device itself doesn't have > information about what processes sent those packets, does it? So that > information would have to come from somewhere else. Netstat has > information about what processes are connected to which ports, but it > doesn't have any information about what packets are sent across those > ports. > > Would it be possible to tie the two together in user-space?
It looks like atop[1] will show bandwidth usage by process, but requires a kernel patch for the functionality. You could probably tie together pcap and netstat output in userspace if you are willing to deal with not being able to always correlate the output, but it may just be easier to apply the atop kernel patch. [1] http://www.atcomputing.nl/Tools/atop -- Byron Clark
signature.asc
Description: Digital signature
/* PLUG: http://plug.org, #utah on irc.freenode.net Unsubscribe: http://plug.org/mailman/options/plug Don't fear the penguin. */
