I have a third party program (tightvnc) which I want to monitor and detect if it loses a connection with a client. I don't care if the client has the program open but isn't doing anything with it, I only want to know if the actual TCP connection is lost.

Since TCP takes forever to die on it's own I was thinking the best way to detect if a connection is lost is by bandwidth the bandwidth on the tcp port allocated to the VNC connection. Are there any tools built in to redhat (RHEL 5.2) which I could use to do this? Since I don't have full control of the operating system I would prefer to use built in tools rather then trying to get a new tool installed.

tcpdump can do this for you. You can't specify a program, but you can watch a specific port.

I think netstat would be a sufficient tool.

I'll look into Tcpdump. As soon as I can get to my linux computer I'll check to see if it comes by default on RHEL.

I had thought of netstat, but I looked through the man page and couldn't find an argument to get a data on the bandwidth used by each program. This seems like something netstat should have, so it's possible I'm just blind and missed it somehow. If you can tell me what arguments I should be using with netstat I would be happy to use it.

netstat will not show the bandwidth for each port, but it will show what ports are connected and the status. Once a socket drops the connection, the port should go to the TIME_WAIT state, and netstat will show this.

tcpdump won't necessary show the bandwidth, but the raw data going across the line. You can capture that and extrapolate your own metrics.