Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a linux server that keeps getting its NIC overloaded and I need to visualize how and why this is occurring based on connections and CPU utilization. How do I do this?

For example; for me to visualize disk iowait I use tools such as atop and iotop that tell me the PID of the process and its CPU usage; using this information I can find which PID is overloading the server.

The problem is that I'm experiencing the same issue with networking and am unable to isolate and troubleshoot the problem b/c I'm unable to find which processes are linked to which connections (I can use netstat I know but netstat doesn't tell me CPU usage).

Now that I have made that clear I need to be able to monitor conntrack and netfilter for CPU usage and/or kernel time. How do I do this? Conventional tools such as ps, top, and htop are not capable of doing this. I've been suggested to check interrupts but that doesn't seem "right" to me.

share|improve this question

You can use wireshark / ethereal / tcpdump to dump all of the traffic, implicitly dumping the traffic that overloads the PC. This doesn't get you CPU info, but it tells you exactly what ports and data are involved, which should lead you directly to the process involved.

As with all interactions with a problem system, this measurement may influence the behavior, but that is also more likely to result in a faster answer than a less accurate one (IMO). If this measurement does cause the system to function correctly instead of failing the way you would like, you could use a tap and measure using an external device.

You can also use 'iftop' to show bandwidth hogs, but remember that bandwidth != CPU.

share|improve this answer
up vote 2 down vote accepted

The best way that I have found to do this is to watch the kernel time. If the kernel time is high then I'll check /proc/interrupts. To further debug this I'll use perf. pktstat is also good to visualize the flow of traffic.

collectl -stnc is also good.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.