I have a script that uses tshark in conjunction to gawk to get statistics on the number of captured packet per detected IPs. Gawk is however not updating the screen properly but I cannot find a better way to do it.

Which terminal based program or script would you use to monitor newly found IPs and and count the number of packet of those IPs.

I need the script/utility to be do statistics in a dynamical fashion, along the packet capture.

# Monitor the number of packets per newly found IP (source or destination) using ngrep

ngrep|grep -oE "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}"    | tee /root/.config/geany/.$(date-all) |  gawk -F '\t' -v clear="$(tput clear)" '
    BEGIN{PROCINFO["sorted_in"] = "@ind_str_asc"}
              count[$1 ? $1 : "Unknown"]++
                  count[$2 ? $2 : "Unknown"]++
                      printf "%s", clear
                          for (c in count)
                                    printf "%5d %s\n", count[c], c
                                }' |tee /root/.config/geany/.ip-stat-$(date-all)

1 Answer 1


Although the output of this program differs from your script, pktstat might give you the information you need. I used the following invocation to list the number of packets (as opposed to just the packet rate), and their totals, with no DNS lookups:

pktstat -n -p -T

In practice I like iftop for this kind of realtime monitoring, but it only shows bandwidth, not the number of packets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.