If you have ever wanted a traffic graph for a tunnel client, you know the awkward part: the client usually owns the socket. You cannot wrap it, you cannot ask it, and its status endpoint is often a step-function of "connected" or not.

When I was building MoonProxy — a cross-platform GUI desktop client for FRP — I hit exactly this. frpc exposes an /api/status endpoint, and it is genuinely useful: it tells you whether the tunnel is up. What it does not expose is a single byte counter. Yet the whole point of a tunnel dashboard is answering "how much data is moving right now?"

This is a writeup of the pattern I landed on, because it generalizes well beyond FRP.

The constraint

The naive approach is to watch the process's network usage from the outside. On Linux that is /proc/<pid>/net/dev ; on macOS and Windows it is a platform-specific call.…