Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been recently attacked using DoS attack on random ports.

I wasn't able to get the attackers IP and now I would like to find it.

What tool can show me bandwidth (in Kbits/Mbits) used by each client IP?

It's dedicated server. I know that I'm under attack because of flow charts in dedi's panel (up to 800 mbps) Thanks for all your replies.

share|improve this question
Are you directly connected to the Internet? Are you behind a router? We need a lot more information here. – SpacemanSpiff Dec 28 '10 at 15:30
Hmmm... You don't have any information on the "attacker" yet you know you were "attacked". How so? – joeqwerty Dec 28 '10 at 15:35
In addition, how is knowing the client bandwidth going to help you find the culprit? Do legitimate clients not use any bandwidth? – joeqwerty Dec 28 '10 at 15:40
edited the question, added info. – mickula Dec 28 '10 at 16:15

Cacti is a pretty good software package for this sort of thing, as is nagios. But as this DoS attack has already occurred, they won't be of much use - they need to be running at the time.

share|improve this answer
Of course I know. I think it will happen again. – mickula Dec 28 '10 at 16:16

iftop will show you that information live, though not historically.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.