1. Oracle Solaris 11.4 DTrace (Dynamic Tracing) Guide
  2. DTrace Providers
  3. Network and Network Service Protocol Providers
  4. tcp Provider
  5. Using the tcp Provider
  6. Packets by Local Port

Packets by Local Port

This DTrace one-liner counts TCP received packets by the local TCP port:

# dtrace -n 'tcp:::receive { @[args[4]->tcp_dport] = count(); }'
dtrace: description 'tcp:::receive ' matched 5 probes
^C

 42303                3
 42634                3
  2049               27
 40648               36
    22              162

The preceding output shows that 162 packets were received for port 22 (ssh), 36 packets were received for port 40648 (an RPC port), 27 packets for 2049 (NFS), and a few packets to high numbered client ports.