Friday, September 24, 2010

TCPDump Top-Talkers script

I remember back in the days of cypress Linux, or Red October, that we in the MH office had a top talkers script.  It was good to see, for instance, that the streaming radio you were listening to didn't impact the network too noticeably.  I don't know what the network guys did out there, but I had a need to cook up something out East again.  So I googled it up, found a tcpdump cheat-sheet with it, and there ya go.  Top talkers:
tcpdump -tnn -c 20000 -i eth0  |\
   awk -F "." '{print $1"."$2"."$3"."$4}' |\
   sort | uniq -c | sort -nr |\
   awk ' $1 > 100 ' 
It's nothing like perfect, for it only shows the number of packets a machine's blowing out the NIC and not the size of each one, but that's something which we can add in, I figure.  It's quick, though, and gives a relatively useful ballpark figure, which is all I need today.

Yay for google and tcpdump!

Labels: , ,