Which Linux utility to gather packet statistics?

Question

I have a script that uses tshark in conjunction to gawk to get statistics on the number of captured packet per detected IPs. Gawk is however not updating the screen properly but I cannot find a better way to do it.

Which terminal based program or script would you use to monitor newly found IPs and and count the number of packet of those IPs.

I need the script/utility to be do statistics in a dynamical fashion, along the packet capture.

#!/bin/bash
# Monitor the number of packets per newly found IP (source or destination) using ngrep

ngrep|grep -oE "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}"    | tee /root/.config/geany/.$(date-all) |  gawk -F '\t' -v clear="$(tput clear)" '
    BEGIN{PROCINFO["sorted_in"] = "@ind_str_asc"}
      {
              count[$1 ? $1 : "Unknown"]++
                  count[$2 ? $2 : "Unknown"]++
                      printf "%s", clear
                          for (c in count)
                                    printf "%5d %s\n", count[c], c
                                }' |tee /root/.config/geany/.ip-stat-$(date-all)

Answer 1

Although the output of this program differs from your script, pktstat might give you the information you need. I used the following invocation to list the number of packets (as opposed to just the packet rate), and their totals, with no DNS lookups:

pktstat -n -p -T

In practice I like iftop for this kind of realtime monitoring, but it only shows bandwidth, not the number of packets.