The following example illustrates the use of netstat - the third and sixth columns give the number of bytes read and written. The figures shown are for a client and server sending data to and from each other across the loopback device, so the amounts read and written are the same, because each packet written by the client will be read by the server, and vice-versa.
$ netstat -w 1 -I lo0
input (lo0) output
packets errs bytes packets errs bytes colls
9 0 501 9 0 501 0
8 0 484 8 0 484 0
9 0 492 9 0 492 0
9 0 469 9 0 469 0
^C
$
Graphing this information is a matter of extracting the third and sixth columns, and expressing both as percentages of the highest total so far. Input is shown in blue, output in red.
Note the header mentions the interface in parentheses. If netstat is run for a non-existent interface, the figures are for 'Total'.
$ cat /proc/net/dev
Inter-| Receive | Transmit
face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed
lo: 1562798 8582 0 0 0 0 0 0 1562798 8582 0 0 0 0 0 0
eth0:48527843 406919 0 0 1 0 0 0 4935999 51983 0 0 0 0 0 0
$
To graph the amounts of incoming and outbound data, we extract columns two and ten (using a regular expression, as the first field is not space-separated), and express both figures as percentages of the highest total so far. Reads (receive) are shown in blue, writes (transmit) in red.