up vote 3 down vote favorite
share [g+] share [fb]

I have seen a consistent spike in traffic over my network since Monday morning and I don't know where it's coming from!

I don't have netflow routers (like I would like), I have IPCop firewalls.

Is there any way that's built in to Linux that I can see where the packets are coming from/to? Like a built in packet capture?

If there's not, how do I go about finding where this traffic's coming from?

link|improve this question
93% accept rate
feedback

3 Answers

up vote 1 down vote accepted

Get SSH access into the IPCop box and run iftop. This should give you a real time view of what's happening.

link|improve this answer
1  
I found the jerk that was using all my bandwidth and unplugged him! Thank you, I see myself using this much in the future :) – blsub6 Feb 25 '11 at 18:31
feedback
up vote 0 down vote

Run tcpdump on your ipcop and you will see where the traffic is coming from and going to, IP addresses and ports.

link|improve this answer
feedback
up vote 0 down vote

Moving forward I would recommend you looking into a piece of software called Argus. It generates flow data, similar to (net|j)flows, by watching either pcap files or a promiscuous network interface.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.