Use the BSD licensed libpcap library to ingest pcap style packet captures for arbitrary hosts. Linux generates these types of data and I am interested in comparing traffic volumes between 2 hosts. Since pid / application isn’t in this data using code to consume auditd logs (Linux audit dameon) allow one to tie which applications own wich ports and thus are the ones sending or receiving each packet.
2 Likes