Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking at the traffic graph in pfSense (Version 1.2.2), which we're using as a router / NAT / ect on our network. Recently, I'm seeing a sudden, constant spike of 15 - 30kbps traffic outbound, that is unusual for our network (normally its below 2kbps, we're mostly all inbound traffic)

Is there any way to determine what the source of this traffic is, or where it's going? (Just an internal IP address for source, and external IP address for destination would be all I need)

I've already tried switching the traffic graph to 'LAN' and watching the host list on the right side, but it seems ... flakey. The numbers it shows seem to fade in and out at random, and the values never add up to anywhere near the graph values.

alt text

share|improve this question
up vote 4 down vote accepted

There's some very good plugins for reporting with PFSense 1.2. Have a look in the packages. Darkstat is useful for overall traffic patterns, and ntop is useful for breakdowns (which may be what you are after). bandwidthd has a god-ugly interface, but it can give some very useful long-term statistics.

Unfortuantely I'm not in an office that's got a pfsense box in it at the moment, so my memory can't be any clearer.

share|improve this answer
+1 for ntop or darkstat. Hopefully he's not running the embedded version; packages may work but they're unsupported. – gravyface Apr 20 '10 at 23:31
How do you go about using these packages? I see them listed as installed on pfSense, but do not see any web GUI for them, and SSH'ing into the box, and running the commands at the command line produces a 'Command not found' error. – maxsilver Apr 22 '10 at 17:43
@max, usually you install the package, and then it adds a new menu item. Sometimes you have to dig around to find the menu item because they're not always in the places you would expect. – Mark Henderson Apr 23 '10 at 1:19

Another option is to use the rate package. It will show you the bandwidth being used broken down by IP in realtime. You could then take a network capture to see what's going on.

Ugh stupid firefox plugins blocked the image in your question. Looks like you're already using the rate package.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.