tcpdump mailing list archives

Re: bandwidth by user or process id


From: Gert Doering <gert () greenie muc de>
Date: Tue, 5 Oct 2010 11:46:17 +0200

Hi,

On Tue, Oct 05, 2010 at 02:14:19AM -0700, Patrick Kurz wrote:
For typical point-to-point IP traffic, the combination of local address,
local port, remote address, remote port, and transport protocol (TCP or UDP)
is the closest thing you have to a unique key.

Are you saying, that this method cannot distinguish two different users/PIDs 
downloading huge data from the same remote address to the same local address? 
This was the key point of my original question, and if your method relies on 
addresses and ports only, I have to search for a different solution.

Two differnet local users will have to use different local ports.

That's just the way TCP/UDP works, one of the 5 variables listed above
has to be different for each parallel connection.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert () greenie muc de
fax: +49-89-35655025                        gert () net informatik tu-muenchen de
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.


Current thread: