Gecko [ dataharbor.africa ]

Name	Size	Permission
autofs4.meta	397 B	-rw-r--r--
autofs4.stp	4.07 KB	-rwxr-xr-x
connect_stat.meta	404 B	-rw-r--r--
connect_stat.stp	1019 B	-rwxr-xr-x
dropwatch.meta	494 B	-rw-r--r--
dropwatch.stp	871 B	-rwxr-xr-x
net_xmit_json.meta	453 B	-rw-r--r--
net_xmit_json.stp	1.76 KB	-rw-r--r--
netdev.meta	389 B	-rw-r--r--
netdev.stp	1.42 KB	-rwxr-xr-x
netfilter_drop.meta	630 B	-rw-r--r--
netfilter_drop.stp	1.13 KB	-rwxr-xr-x
netfilter_summary.meta	587 B	-rw-r--r--
netfilter_summary.stp	591 B	-rwxr-xr-x
netfilter_summary.txt	2.81 KB	-rw-r--r--
netfilter_summary_json.meta	511 B	-rw-r--r--
netfilter_summary_json.stp	1.04 KB	-rw-r--r--
nettop.meta	519 B	-rw-r--r--
nettop.stp	1.12 KB	-rwxr-xr-x
nettop.txt	953 B	-rw-r--r--
nfsd-recent.meta	423 B	-rw-r--r--
nfsd-recent.stp	442 B	-rwxr-xr-x
nfsd-trace.meta	314 B	-rw-r--r--
nfsd-trace.stp	701 B	-rw-r--r--
nfsd-trace.txt	876 B	-rw-r--r--
nfsd_unlink.meta	479 B	-rw-r--r--
nfsd_unlink.stp	523 B	-rwxr-xr-x
nfsdtop.meta	405 B	-rw-r--r--
nfsdtop.stp	3.31 KB	-rwxr-xr-x
packet_contents.meta	550 B	-rw-r--r--
packet_contents.stp	216 B	-rwxr-xr-x
packet_contents.txt	2.02 KB	-rw-r--r--
sk_stream_wait_memory.meta	616 B	-rw-r--r--
sk_stream_wait_memory.stp	999 B	-rwxr-xr-x
socket-trace.meta	702 B	-rw-r--r--
socket-trace.stp	222 B	-rwxr-xr-x
socktop	8.93 KB	-rwxr-xr-x
socktop.meta	548 B	-rw-r--r--
socktop.txt	4.04 KB	-rw-r--r--
stp_dump.meta	339 B	-rw-r--r--
stp_dump.stp	568 B	-rw-r--r--
stp_dump.txt	1.59 KB	-rw-r--r--
tcp_connections.meta	625 B	-rw-r--r--
tcp_connections.stp	361 B	-rwxr-xr-x
tcp_init_cwnd.meta	589 B	-rw-r--r--
tcp_init_cwnd.stp	343 B	-rwxr-xr-x
tcp_retransmission.meta	286 B	-rw-r--r--
tcp_retransmission.stp	1.15 KB	-rw-r--r--
tcp_trace.meta	684 B	-rw-r--r--
tcp_trace.stp	18.36 KB	-rwxr-xr-x
tcp_trace.txt	3.38 KB	-rw-r--r--
tcpdumplike.meta	381 B	-rw-r--r--
tcpdumplike.stp	581 B	-rwxr-xr-x
tcpipstat.meta	725 B	-rw-r--r--
tcpipstat.stp	17.82 KB	-rwxr-xr-x
tcpipstat.txt	898 B	-rw-r--r--
who_sent_it.meta	583 B	-rw-r--r--
who_sent_it.stp	477 B	-rw-r--r--
who_sent_it.txt	803 B	-rw-r--r--

Code Editor : netfilter_summary.txt

netfilter_summary.stp - System-Wide Count of Network Packets by IPs

The script watches all IPv4 network traffic on the system. On exit
  the script prints a list showing the number of packets sent along
  source IP address / destination IP address pair encountered, and the
  total number of bytes sent among the pair. The list is ordered from
  greatest to least number of packets seen among the source/destination
  pairs.

$ stap netfilter_summary.stp -T 10

Collecting data... Type Ctrl-C to exit and display results.
205.251.249.28 -->    10.15.16.105 : 122 packets, 259403 total bytes
 54.218.38.124 -->    10.15.16.105 : 6 packets, 3694 total bytes
  10.15.16.136 -->    10.15.16.255 : 3 packets, 108 total bytes
    10.11.5.19 -->    10.15.16.105 : 3 packets, 408 total bytes
173.194.121.14 -->    10.15.16.105 : 2 packets, 104 total bytes
  10.15.16.206 --> 255.255.255.255 : 2 packets, 280 total bytes
  194.68.29.18 -->    10.15.16.105 : 2 packets, 242 total bytes
  10.15.16.138 --> 255.255.255.255 : 2 packets, 280 total bytes
205.251.242.58 -->    10.15.16.105 : 1 packets, 40 total bytes
  50.58.123.35 -->    10.15.16.105 : 1 packets, 52 total bytes
  10.15.16.114 -->    10.15.16.255 : 1 packets, 228 total bytes
  10.15.16.114 --> 255.255.255.255 : 1 packets, 228 total bytes
54.230.195.233 -->    10.15.16.105 : 1 packets, 52 total bytes
 54.230.192.90 -->    10.15.16.105 : 1 packets, 52 total bytes

The output above was from when the system was doing nothing interesting.

Rerunning the script opening numerous tabs to google.com.

$ stap netfilter_summary.stp -T 10

Collecting data... Type Ctrl-C to exit and display results.
 173.194.37.87 -->    10.15.16.105 : 547 packets, 700864 total bytes
173.194.121.15 -->    10.15.16.105 : 214 packets, 240447 total bytes
 173.194.37.79 -->    10.15.16.105 : 213 packets, 222228 total bytes
 173.194.121.3 -->    10.15.16.105 : 136 packets, 162753 total bytes
205.251.249.28 -->    10.15.16.105 : 115 packets, 215980 total bytes
    10.11.5.19 -->    10.15.16.105 : 71 packets, 8894 total bytes
 173.194.121.9 -->    10.15.16.105 : 66 packets, 58162 total bytes
 173.194.37.81 -->    10.15.16.105 : 52 packets, 11046 total bytes
  54.213.74.85 -->    10.15.16.105 : 4 packets, 908 total bytes
     127.0.0.1 -->       127.0.0.1 : 2 packets, 104 total bytes
  10.10.161.32 -->    10.15.16.105 : 1 packets, 122 total bytes
173.252.100.27 -->    10.15.16.105 : 1 packets, 93 total bytes
  64.32.24.176 -->    10.15.16.105 : 1 packets, 149 total bytes
  10.15.16.136 -->    10.15.16.255 : 1 packets, 36 total bytes
 198.58.96.245 -->    10.15.16.105 : 1 packets, 112 total bytes

Heavily used connections will rise to the top of the list.

The script's output gives a basic understanding of where packets are
being sent to and received from. Other scripts can be used to supplement
the gathered information.

${this.title}

Code Editor : netfilter_summary.txt