I've looking after some Debian boxes and occasionally I see a big spike in the network traffic. I'm graphing metrics with graphite (being fed by a sensu check which gathers per-interface metrics every minute) and occasionally see this sort of thing:
I have no idea what's causing this, as I never manage to catch it while it's in progress. It'd be nice to figure out what's causing this, so what's the best approach to try and figure out what this could be?
I guess what I'm really after is this: Is there a way to audit a network connection (and process id/name) if the amount of data it has sent/received trips over a certain amount or rate?