A process-based network traffic statistics method

Abstract

The present invention provides a process-based network traffic statistics method, comprising the following steps: a coroutine captures the front-end data packet from the packet queue, performs transport layer filtering, network layer filtering, and application layer filtering, calculates the effective data volume of the data packet, pushes the effective data volume value to a data channel, calculates the effective data volume value within the data channel, and continuously obtains the traffic value of the process. The method has the following advantages: 1. It is simple to use out of the box, using a compiled binary executable program, and can be used quickly and cheaply in Linux x86 and ARM environments; 2. Starting from the application layer, it filters traffic based on process and service names, thereby better aligning with business objectives, reducing interference factors, and reducing analysis difficulty. This method effectively reduces the difficulty of observation in scenarios such as port negotiation, where there are many ports and they change dynamically.