This has been driving me nuts but my server has been using a highly excessive amount of bandwidth for the last two months, and I can't figure out how/why/where.

This month, for example, it's used 210 Gb download traffic (inbound to the server), but I can't figure out where it's going - the disk usage isn't going up (and the server only has a 20Gb drive anyway), and the upload (outbound) traffic was only 4 Gb for the month.

My logs don't show any unusual Apache, Ftp, Smtp or authentication activity in the logs; I am running a Quassel and an IRC server, but I would've figured that for all the data that'd be inbound to the server, there'd be an approximately equal amount outbound for those kinds of processes. I also have MySQL running, and that gets accessed by one user (from a script) from a remote server, but since the only instructions the script executes is for creating entries, I'd expect my disk usage to go up proportional to the inbound traffic if this were the cause. I haven't started shutting down processes to try and eliminate the problem because, apart from FTP and Quassel, all of these services are being used by other people, so their uptime is semi-critical.

Does anyone have any ideas what might be causing this, and any daemon or program I can use to log traffic totals on a per-process basis (for Ubuntu 10.04 Server x86_64)?

  • Are you sure you don't have the inbound and outbound reversed..? And that "upload" is uploading to the server thus inbound, and "download" is downloading from the server, thus outbound.
    – Mark
    Feb 25, 2012 at 0:49

2 Answers 2


You can monitor network traffic using ntop tool in realtime. ntop clears its logs on restart, this is annoying a bit, but you still can run it for a period of time to classify your traffic. As I recall it can classify the traffic by client IPs, ports and protocols. If you know a port you will be able to find a related service using fuser command line tool.

  • Excellent! This tool seems to provide the comprehensive statistics I need. Now, alas, I still have to figure out exactly what is causing the bandwidth usage :S
    – jonodlo
    Feb 4, 2011 at 17:52

There is another tool: jnettop. It is command line based, and you can use the port number to search for process name/PID (netstat).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .