systemd [0], which you're probably already using, can do IP Accounting: > TL;DR: systemd now can do per-service IP traffic accounting, as well as access contro

systemd [0], which you're probably already using, can do IP Accounting: > TL;DR: systemd now can do per-service IP traffic accounting, as well as access control for IP address ranges. It can be enabled using: [Service] IPAccounting=yes systemd won't, AFAIK, give you per second values -- just the aggregate totals -- so you'd have to constantly retrieve the updated values and calculate the differences yourself. The totals can be obtained programmatically via the D-Bus APIs. They'll also be shown in the "systemctl status ..." output or you can grab just the value(s) you're interested in with "systemctl show ...". However... systemd's functionality is basically just a thin wrapper around eBPF (in the kernel, since sometime around 4.8, I think?) so you can do it without systemd too. In fact, the author of this article has also written a nice introduction to XDP and eBPF [1]! That article includes an example "XDP program" which counts the number of packets that have been blocked from a list of source IP addresses -- it could be modified fairly easily to do what you want, I think. --- [0]: http://0pointer.net/blog/ip-accounting-and-access-lists-with-systemd.html http://0pointer.net/blog/ip-accounting-and-access-lists-with... [1]: https://jvns.ca/blog/2017/04/07/xdp-bpf-tutorial/ https://jvns.ca/blog/2017/04/07/xdp-bpf-tutorial/