3

I have seen a consistent spike in traffic over my network since Monday morning and I don't know where it's coming from!

I don't have netflow routers (like I would like), I have IPCop firewalls.

Is there any way that's built in to Linux that I can see where the packets are coming from/to? Like a built in packet capture?

If there's not, how do I go about finding where this traffic's coming from?

Improve this question

3 Answers 3

Reset to default
1

Get SSH access into the IPCop box and run iftop. This should give you a real time view of what's happening.

Improve this answer
1
  • 1
    I found the jerk that was using all my bandwidth and unplugged him! Thank you, I see myself using this much in the future :)
    – blsub6
    Feb 25, 2011 at 18:31
1

Moving forward I would recommend you looking into a piece of software called Argus. It generates flow data, similar to (net|j)flows, by watching either pcap files or a promiscuous network interface.

Improve this answer
0

Run tcpdump on your ipcop and you will see where the traffic is coming from and going to, IP addresses and ports.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .