I'm writing a script that parses the output of lsof to show a list of what processes have sockets open (similar to what netstat shows). lsof also gives me a file descriptor. What I want to do now is have my script also tell how much data (in KB/sec) is being sent/received through that socket.So far I've looked at:nethogs: Tells me a process's network I/O, but only per process, not per socket.iotop: Tells me disk I/O per process; doesn't appear to be able to tell network I/O nor I/O per socket./proc/pid/fd/: Doesn't look like this can tell me much at all.fatrace: Tells me what files (not sockets) a process accesses.iostat: Tells me average I/O stats per disk.tcpdump: Gives me a dump of all traffic per IP; doesn't appear to be able to tell which socket the traffic belongs to.strace -p pid -e trace=network -s 0: Tells me every time the given process calls certain socket functions, which seems useful, but in practice is only giving me a lot of recvfrom(13, 0x7feed8fb3074, 4096, 0, 0, 0) = -1 EAGAIN (Resource temporarily unavailable)strace -p pid -e trace=read,write -s: Tells me the result of each read/write call.strace looks promising, but I'm not sure I'm working it correctly (is read,write enough?), plus it seems like there would be a lot of overhead. (For every process with an open socket I'd have to run an instance of strace and parse the output.)Does the Linux kernel provide a nicer means to measure how much I/O is going on per fd/socket? Possibly something could be set up with iptables or hacking on nethogs?
lsof: measure I/O rate of a socket fd
linux;kernel;proc;lsof;statistics