-6

I just checked bandwith usage on SolusVM and it was 250gb in 2 days, and I know it's one of my users through OpenVPN.

I think it is a torrent because it is upload + download 24/7.

I want to find out who is doing this by getting their username. I make accounts for every user on my VPN ( adduser name -s /bin/false/nologin ).

Is it possible to see who is uploading? I need to get the username or subnet ( like 10.8.1.1 ).

Improve this question
1
  • 5
    No offense, but you probably should have figured this kind of thing out before starting a VPN business.
    – EEAA
    Jan 19, 2013 at 19:46

2 Answers 2

Reset to default
2

Use tcpdump to identify the source IP of the traffic, then look through your OpenVPN logs to see who that IP address was given to.

Improve this answer
2
  • There is a lot of connections from the torrents. I need to be able to filter it so that I can see who uploads the most.
    – Niel
    Jan 19, 2013 at 18:50
  • So grab all of the source IPs and see which one is the most active.
    – EEAA
    Jan 19, 2013 at 19:11
1

Check the (default) /etc/openvpn/openvpn-status file. If the user is connected you'll see the bytes_sent and bytes_received columns. These columns reset if an user (re)connects though.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.