Is there any way to find out which application on a server is responsible for incoming traffic?

I have a debian linux server that has a lot of incoming traffic and would like to know if someone managed to hack his way into it or if there's a faulty web-application (apache2 + PHP) and I just have to fix a bug.

Any suggestions? Applications I need to know about? "Long Time Network Monitors"?


You could try using iptraf and pktstat to help visualise your network traffic. They are both in the apt repositories.

They will show you all incoming/outgoing connections, services that they are connected to, traffic bandwidth for each connection, ipaddress/named entries and much more. That will help you track down the offending app (with some help from netstat).

Have fun!

  • pktstat did it for me. Helped me to find out that my provider charged me for traffic of another server, too - due to a routing problem. – BlaM Sep 7 '09 at 16:05
  • glad to hear it. – sybreon Sep 8 '09 at 0:49

For specific php/apache monitoring, mod_status will show you a web accessible list of all current apache connections. To see all PHP traffic, you can monitor from the command line using

watch -n1 "/etc/init.d/httpd fullstatus | grep .php | egrep \"GET|POST\""

Don't forget to prevent outside access with

<Location /server-status>
SetHandler server-status
Order Deny,Allow
Deny from all
Allow from .foo.com

For an all round traffic stats, except iptraf you can try bandwithd. I used it before and it is able to produce nice graphs for traffic based on source <-> target ip, breakdown of traffic by protocols etc. All of this in real time ;) It is included in both debian and ubuntu.

  • I can't find bandwithd in debian. Any hints where to look? – BlaM Sep 7 '09 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.