Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hi all!


So, my hosting company has a network usage graph for my dedicated server. It seems that one day earlier this month, my network usage suddenly spiked with several hundred megabytes transferred (usually it's in the tens, not hundreds). It was probably me, but i just can't be sure who or what it was.


So my question is; does anyone know of any host based solution for monitoring network usage that would tell me the client's IP-address, the port/service he/she used?

What I don't want

I'm just guessing that someone will suggest i use nagios, munin, zabbix, cacti, mrtg - I've also looked at those, but a graph over network usage will not give me the answers I'm looking for. :-)

Almost there

I've already looked at a lot of monitoring solutions, and I've tried [ntop][], [darkstat][] and others. Darkstat just didn't give me the answers. Although it listed a lot of statistics, and i could list the clients - it doesn't show me the network usage for a particular period. Ntop is by far the best I've seen so far - but i think it mostly shows current network usage, not the historical part. I could run apt-get upgrade and download a whole bunch of software, but not see it in the log afterwards.

share|improve this question
up vote 2 down vote accepted

netflow tools + flow generator of some sort will get you report that you are looking for. Also this. If you are confused about how to use flow-tools to generate a report that you need you can start here

share|improve this answer
Great! Thanks! :-) That was probably what i was looking for! :-) I set up fprobe to collect packages (via some kind of tcpdump) and i used nfsen to collect the data. nfsen uses nfdump to listen for information from fprobe and show it in a web-interface. nfsen allows me to view graphs over network usage, but it also allows me to see output of nfdump-reports over which IP connected to my server, and on which tcp/udp port. exactly what i wanted! :-) – olemartinorg Jun 23 '11 at 20:37

You mentioned ntop which I think is probably the best answer for the type of query you have. I run ntop in an "as needed" capacity rather than leaving it going all the time.

If you have any idea on how to reproduce the spike in traffic, I'd start ntop first and then pay attention to your traditional bandwidth graphs. Once you recreate the problem, switch over to ntop's interface which gives you several methods to "drill down" on the data. Your problem host should be easy to spot.

share|improve this answer
Yeah, ntop is great - but i just can't seem to get to show me historical data.. :-) If I could reproduce the spike in traffic, I would have to know a little bit about how it happened - and that's what I'm trying to find out.. ;-) – olemartinorg Jun 24 '11 at 8:12

For adhoc monitoring I would recommend iptraf. It shows all currently open connections with IP addresses and the number of packets and bytes in both directions. It does, however, not support historical data (from what I know, but then maybe somebody else knows more about that).

You could try and just capture traffic using tcpdump. You probably have to limit the capture size to the bare minimum, and then try and analyze that data later with wireshark or other tools that can analyze pcap files.

share|improve this answer
Yeah, I tried iptraf a long time ago.. The problem is, as you say, it doesn't show historical data - and i would have to sit and watch iptraf for a month before i found the same kind of spike.. ;-) regarding tcpdump, that would actually show historical data - but it would also be a pain analyzing the whole dump.. :-P – olemartinorg Jun 24 '11 at 8:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.