Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This has been driving me nuts but my server has been using a highly excessive amount of bandwidth for the last two months, and I can't figure out how/why/where.

This month, for example, it's used 210 Gb download traffic (inbound to the server), but I can't figure out where it's going - the disk usage isn't going up (and the server only has a 20Gb drive anyway), and the upload (outbound) traffic was only 4 Gb for the month.

My logs don't show any unusual Apache, Ftp, Smtp or authentication activity in the logs; I am running a Quassel and an IRC server, but I would've figured that for all the data that'd be inbound to the server, there'd be an approximately equal amount outbound for those kinds of processes. I also have MySQL running, and that gets accessed by one user (from a script) from a remote server, but since the only instructions the script executes is for creating entries, I'd expect my disk usage to go up proportional to the inbound traffic if this were the cause. I haven't started shutting down processes to try and eliminate the problem because, apart from FTP and Quassel, all of these services are being used by other people, so their uptime is semi-critical.

Does anyone have any ideas what might be causing this, and any daemon or program I can use to log traffic totals on a per-process basis (for Ubuntu 10.04 Server x86_64)?

share|improve this question
Are you sure you don't have the inbound and outbound reversed..? And that "upload" is uploading to the server thus inbound, and "download" is downloading from the server, thus outbound. – Mark Feb 25 '12 at 0:49
up vote 3 down vote accepted

You can monitor network traffic using ntop tool in realtime. ntop clears its logs on restart, this is annoying a bit, but you still can run it for a period of time to classify your traffic. As I recall it can classify the traffic by client IPs, ports and protocols. If you know a port you will be able to find a related service using fuser command line tool.

share|improve this answer
Excellent! This tool seems to provide the comprehensive statistics I need. Now, alas, I still have to figure out exactly what is causing the bandwidth usage :S – jonodlo Feb 4 '11 at 17:52

There is another tool: jnettop. It is command line based, and you can use the port number to search for process name/PID (netstat).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.