New answers tagged traffic
As far as I understand you want almost the same setup as I have, so I will try and describe it: My KVM server with 2 NICs runs Ubuntu 13.10 Server with KVM+Libvirt. One NIC serves as bridge on the LAN and the other is passed directly from ISP to the virtual firewall (running Vyatta). My ISP assigns IPs with DHCP bound to the MAC address. The virtual ...
Simple. Let's assume: WAN -> eth0 LAN -> eth1 What you will want to do is create a bridge (let's name it br_wan) with device eth0 and leave it with no IP configured at the host (the host will have no IP set for br_wan). Now create another bridge (let's call it br_lan) with device eth1 and let the host take its IP from this bridge via DHCP (assuming ...
Use tcpdump, and add the parameter "host" to filter the specific IP. e.g. tcpdump -vvi eth0 host 192.168.0.2
You need to set up packet sniffing on a device which all traffic passes through. Example: set your computer as the gateway for your LAN and sniff the traffic.
You can possibly make a script which periodically calls any tool like this (http://nethogs.sourceforge.net/) or similar others. Keep appending this output to a file with time info. Run this script as a daemon. Next day you can see what is that "culprit" process. This thread seems to have more such tools : Network usage top/htop on Linux
Top 50 recent answers are included