How can I passively monitor the packet loss on TCP connections to/from my machine?
Basically, I'd like a tool that sits in the background and watches TCP ack/nak/re-transmits to generate a report on which peer IP addresses "seem" to be experiencing heavy loss.
Most questions like this that I find of SF suggest using tools like iperf. But, I need to monitor connections to/from a real application on my machine.
Is this data just sitting there in the Linux TCP stack?
I'm running gkrellm which shows that some process on my Debian Linux system is writing approx 500KB/s to eth0. I'd like to find out which process it is. I know a little bit about netstat, but it shows a gazillion open TCP connections and I can't seem to make it produce any information about traffic.
Does anybody know how I can get a list of processes that are actually using the eth0 interface so that I can track down the offender?
FOLLOWUP: The Debian Linux distribution contains a nethogs package which solves this problem definitively. Related tools that are not quite on the mark include iftop, netstat, and lsof.
I was wondering if there is an easy and lightweight method to viewing what programs are installed on a remote machine? I am tempted to use Spiceworks but I would like something more lightweight like a script. I have been playing around with WMIC a little and can get a list of programs for my computer but I don't know if I can do the same with it for a remote computer. Any ideas?
Edit: Sorry that I forgot the OS, we are using mostly Windows XP and 7, I use Windows 7. I am looking for something to be run in the background without a user that is currently using the computer knowing. I would like to be able to do it during the workday while people are working and do so without interrupting them. I do appreciate the Linux answers since I am trying to learn more about Linux and plan to personally change over sometime.
I find too many incorrect checksum errors from a TCPDUMP done on a GNU Linux 64bit server. There are close to 50% incorrect chekcsums in the export?
cksum 0xe61f (incorrect (-> 0x8c37)
How can we interpret this data? Does it affect performance a lot?
I want to observe the HTTPs protocol. How can I use a Wireshark filter to do that?