TCP port traffic monitoring

pmacctd.conf

! pmacctd configuration
!
!
!
daemonize: true
pidfile: /var/run/pmacctd.pid
syslog: daemon
!
! interested in in and outbound traffic
aggregate: src_host,src_port,dst_host,dst_port
! on this interface
interface: eth0

shell.sh

$ pmacct -s | head -2
SRC_IP         DST_IP       SRC_PORT  PACKETS  BYTES
200.74.77.221  94.23.121.1  57602     4164     180554

traffic_counters.sh

#!/usr/bin/env bash

# set -x

port="${1:-6201}"
pmacctd_uptime="$(ps -eo cmd,etime | awk '/pmacctd.+Core/ && ! /awk/ { print $5 }')"

echo -e "pmacctd running for: $pmacctd_uptime\n"
echo "PORT: $port"

echo -e "\npmacct counters"
pmacct -c src_port -N "$port" -n bytes | awk '{ print $1 " Bytes"; print $1 / 2^30 " Gigabytes" }'

echo -e "\npmacct + awk counters"
pmacct -s | awk '/ '"$port"' / { total+=$5+$6 } END { print total " Bytes"; print total / 2^30 " Gigabytes" }'

PORT: 6201

pmacct counters
883453840 Bytes
0.822781 Gigabytes

pmacct + awk counters
897856077 Bytes
0.836194 Gigabytes

Difference grows over time:

pmacctd running for: 02:31:57

PORT: 6201

pmacct counters
3386469838 Bytes
3.1539 Gigabytes

pmacct + awk counters
7833975334 Bytes
7.29596 Gigabytes