Home / server / Questions / 240351
Accepted
blsub6
Asked: 2011-02-26 09:49:14 +0800 CST

How do I find out what all this traffic is?

  • 772

I have seen a consistent spike in traffic over my network since Monday morning and I don't know where it's coming from!

I don't have netflow routers (like I would like), I have IPCop firewalls.

Is there any way that's built in to Linux that I can see where the packets are coming from/to? Like a built in packet capture?

If there's not, how do I go about finding where this traffic's coming from?

firewall linux wireshark ipcop traffic-management

3 Answers

  1. Best Answer

    Get SSH access into the IPCop box and run iftop. This should give you a real time view of what's happening.

    • 1

  2. Moving forward I would recommend you looking into a piece of software called Argus. It generates flow data, similar to (net|j)flows, by watching either pcap files or a promiscuous network interface.

    • 1

  3. Run tcpdump on your ipcop and you will see where the traffic is coming from and going to, IP addresses and ports.

    • 0