view received packets to specific UDP/TCP socket

m4rtin · 10-09-2011, 06:43 PM

I would like to find out received datagrams to particular UDP socket and packets to specific TCP socket using netstat. One is easily able to check this information per protocol- for example "netstat -s --udp" gives:

Code:

Udp:
    23344 packets received
    0 packets to unknown port received.
    0 packet receive errors
    80117 packets sent

..and "netstat -s --tcp" outputs:

Code:

Tcp:
    18782079 active connections openings
    36762 passive connection openings
    1261775 failed connection attempts
    54981 connection resets received
    2 connections established
    23431679 segments received
    37719328 segments send out
    18012073 segments retransmited
    23 bad segments received.
    610940 resets sent

..but how to see this information for one specific socket? For example I have a SSH server listening on port 22:

Code:

tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      11642/sshd

..how to see received TCP segments to this socket?

kasl33 · 10-10-2011, 12:51 AM

try taking the code that you used to get the final result, but rather than manually formatting it, use grep:

Code:

 command you used | grep -i "sshd"

m4rtin · 10-10-2011, 12:29 PM

Quote:

Originally Posted by kasl33

try taking the code that you used to get the final result, but rather than manually formatting it, use grep:

Code:

 command you used | grep -i "sshd"

Unfortunately this does not work. For example netstat -s --tcp prints out summary information for all TCP statistics, but I would like to have such statistics per process. I'm afraid it's not possible with netstat, but is there some other more low-level tool which might do the thing?