portop Traffic
Established TCP connections show how many bytes they sent and received, and the rate between two refreshes.
Sources
| System | Read from |
|---|---|
| Linux | The kernel's socket diagnostics over netlink, as ss -ti shows them; no root and no eBPF |
| macOS | A nettop snapshot; other users' connections need sudo |
| Windows | Not available: Windows keeps these counters only for connections an administrator enabled statistics on, and portop does not change system settings |
Where it appears
The TRAFFIC column in the established view (sortable, busiest first), the remote cell of the web dashboard and Cockpit, and rx_bytes/tx_bytes in JSON. Turn it off with --no-traffic or resolve_traffic: false.