"Easy" way to check which https requests cause highest network traffic

[M-Stenzel]

Hi team,

my sslh manages ca. 20 different https addresses on a Linux host.
Recently I experience a lot of network traffic.

Is there any "easy" way to find out which http subdomains cause the highest traffic?
I know, there is sth. like wireshark, but I would like to prefer sth. more easy to use. Moreover I do not
know whether I can extract that information from wireshark directly.

Best would be to know about GBit/s or GBit/h for each subdomain that sslh serves.

Thank you in advance,

Martin.

[yrutschle]

There is no way to measure traffic, but you can easily measure the number of hits by looking at the logs.
I am not sure sslh is the right place to do that honestly, if I needed that information I would run tcpdump with a custom script to process the output, as you get each flow's target and data sizes.