Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to find out which application on a server is responsible for incoming traffic?

I have a debian linux server that has a lot of incoming traffic and would like to know if someone managed to hack his way into it or if there's a faulty web-application (apache2 + PHP) and I just have to fix a bug.

Any suggestions? Applications I need to know about? "Long Time Network Monitors"?

share|improve this question
up vote 1 down vote accepted

You could try using iptraf and pktstat to help visualise your network traffic. They are both in the apt repositories.

They will show you all incoming/outgoing connections, services that they are connected to, traffic bandwidth for each connection, ipaddress/named entries and much more. That will help you track down the offending app (with some help from netstat).

Have fun!

share|improve this answer
pktstat did it for me. Helped me to find out that my provider charged me for traffic of another server, too - due to a routing problem. – BlaM Sep 7 '09 at 16:05
glad to hear it. – sybreon Sep 8 '09 at 0:49

For specific php/apache monitoring, mod_status will show you a web accessible list of all current apache connections. To see all PHP traffic, you can monitor from the command line using

watch -n1 "/etc/init.d/httpd fullstatus | grep .php | egrep \"GET|POST\""

Don't forget to prevent outside access with

<Location /server-status>
SetHandler server-status
Order Deny,Allow
Deny from all
Allow from
share|improve this answer

For an all round traffic stats, except iptraf you can try bandwithd. I used it before and it is able to produce nice graphs for traffic based on source <-> target ip, breakdown of traffic by protocols etc. All of this in real time ;) It is included in both debian and ubuntu.

share|improve this answer
I can't find bandwithd in debian. Any hints where to look? – BlaM Sep 7 '09 at 15:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.