Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I just checked bandwith usage on SolusVM and it was 250gb in 2 days, and I know it's one of my users through OpenVPN.

I think it is a torrent because it is upload + download 24/7.

I want to find out who is doing this by getting their username. I make accounts for every user on my VPN ( adduser name -s /bin/false/nologin ).

Is it possible to see who is uploading? I need to get the username or subnet ( like ).

share|improve this question
No offense, but you probably should have figured this kind of thing out before starting a VPN business. –  EEAA Jan 19 '13 at 19:46

2 Answers 2

Use tcpdump to identify the source IP of the traffic, then look through your OpenVPN logs to see who that IP address was given to.

share|improve this answer
There is a lot of connections from the torrents. I need to be able to filter it so that I can see who uploads the most. –  Niel Jan 19 '13 at 18:50
So grab all of the source IPs and see which one is the most active. –  EEAA Jan 19 '13 at 19:11

Check the (default) /etc/openvpn/openvpn-status file. If the user is connected you'll see the bytes_sent and bytes_received columns. These columns reset if an user (re)connects though.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.