Counting Received Packets by Host Address
This DTrace one-liner counts received packets by host address:
# dtrace -n 'ip:::receive { @[args[2]->ip_saddr] = count(); }'
dtrace: description 'ip:::receive ' matched 4 probes
^C
192.0.2.5/27 1
192.0.2.20/27 4
fe80::214:4fff:fe3b:76c8 9
127.0.0.1 14
192.0.2.25/27 28
The preceding output shows that 28 IP packets were received from 192.0.2.25/27, 14 IP packets from 127.0.0.1, and so on.