Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there any way to find out which application on a server is responsible for incoming traffic?

I have a debian linux server that has a lot of incoming traffic and would like to know if someone managed to hack his way into it or if there's a faulty web-application (apache2 + PHP) and I just have to fix a bug.

Any suggestions? Applications I need to know about? "Long Time Network Monitors"?

share|improve this question
add comment

3 Answers 3

up vote 1 down vote accepted

You could try using iptraf and pktstat to help visualise your network traffic. They are both in the apt repositories.

They will show you all incoming/outgoing connections, services that they are connected to, traffic bandwidth for each connection, ipaddress/named entries and much more. That will help you track down the offending app (with some help from netstat).

Have fun!

share|improve this answer
    
pktstat did it for me. Helped me to find out that my provider charged me for traffic of another server, too - due to a routing problem. –  BlaM Sep 7 '09 at 16:05
    
glad to hear it. –  sybreon Sep 8 '09 at 0:49
add comment

For specific php/apache monitoring, mod_status will show you a web accessible list of all current apache connections. To see all PHP traffic, you can monitor from the command line using

watch -n1 "/etc/init.d/httpd fullstatus | grep .php | egrep \"GET|POST\""

Don't forget to prevent outside access with

<Location /server-status>
SetHandler server-status
Order Deny,Allow
Deny from all
Allow from .foo.com
</Location>
share|improve this answer
add comment

For an all round traffic stats, except iptraf you can try bandwithd. I used it before and it is able to produce nice graphs for traffic based on source <-> target ip, breakdown of traffic by protocols etc. All of this in real time ;) It is included in both debian and ubuntu.

share|improve this answer
    
I can't find bandwithd in debian. Any hints where to look? –  BlaM Sep 7 '09 at 15:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.