Matt Gemmell

TOLL is available now!

An action-thriller novel — book 2 in the KESTREL series.

★★★★★ — Amazon

Network traffic and netstat

source 1 min read

Network activity monitoring: how to?
It's time for a quick toy project, namely hacking up 
a network activity monitor. The requirements are really 
simple, of the order of Activity Monitor's Network data 
in/out graph (a line graph over time, with one line for 
incoming traffic and another for outgoing).

My basic premise at this point is that I'll wrap a 
netstat NSTask with the periodic (-w) flag specified, 
and repeatedly parse the output and update a graph. 
Sounds simple enough. However, I have two issues with 
  1. I find netstat's man-page a little mind-melting. I have no idea what network interfaces or such to specify. My assumption is that I'd just specify the inet address family in order to monitor the kind of traffic I'm interested in.
  2. In such a graph, the x-axis is time, but how do you determine the extent of the y-axis (amount of traffic)? Is it arbitrary? Or just up to the sum of the theoretical maximums allowed by the interfaces' hardware (and if so, how do I actually determine that programmatically)? Or what?
If anyone can enlighten me a bit about how to approach the problem, 
I'd be most grateful.