Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have seen a consistent spike in traffic over my network since Monday morning and I don't know where it's coming from!

I don't have netflow routers (like I would like), I have IPCop firewalls.

Is there any way that's built in to Linux that I can see where the packets are coming from/to? Like a built in packet capture?

If there's not, how do I go about finding where this traffic's coming from?

share|improve this question
up vote 1 down vote accepted

Get SSH access into the IPCop box and run iftop. This should give you a real time view of what's happening.

share|improve this answer
I found the jerk that was using all my bandwidth and unplugged him! Thank you, I see myself using this much in the future :) – blsub6 Feb 25 '11 at 18:31

Moving forward I would recommend you looking into a piece of software called Argus. It generates flow data, similar to (net|j)flows, by watching either pcap files or a promiscuous network interface.

share|improve this answer

Run tcpdump on your ipcop and you will see where the traffic is coming from and going to, IP addresses and ports.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.