0

Is there any way to find out which application on a server is responsible for incoming traffic?

I have a debian linux server that has a lot of incoming traffic and would like to know if someone managed to hack his way into it or if there's a faulty web-application (apache2 + PHP) and I just have to fix a bug.

Any suggestions? Applications I need to know about? "Long Time Network Monitors"?

3 Answers 3

1

You could try using iptraf and pktstat to help visualise your network traffic. They are both in the apt repositories.

They will show you all incoming/outgoing connections, services that they are connected to, traffic bandwidth for each connection, ipaddress/named entries and much more. That will help you track down the offending app (with some help from netstat).

Have fun!

2
  • pktstat did it for me. Helped me to find out that my provider charged me for traffic of another server, too - due to a routing problem.
    – BlaM
    Sep 7, 2009 at 16:05
  • glad to hear it.
    – sybreon
    Sep 8, 2009 at 0:49
1

For specific php/apache monitoring, mod_status will show you a web accessible list of all current apache connections. To see all PHP traffic, you can monitor from the command line using

watch -n1 "/etc/init.d/httpd fullstatus | grep .php | egrep \"GET|POST\""

Don't forget to prevent outside access with

<Location /server-status>
SetHandler server-status
Order Deny,Allow
Deny from all
Allow from .foo.com
</Location>
1

For an all round traffic stats, except iptraf you can try bandwithd. I used it before and it is able to produce nice graphs for traffic based on source <-> target ip, breakdown of traffic by protocols etc. All of this in real time ;) It is included in both debian and ubuntu.

1
  • I can't find bandwithd in debian. Any hints where to look?
    – BlaM
    Sep 7, 2009 at 15:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .