On a server a few KVM/libvirt virtual machines are running. Sometimes these use lots of GB in network bandwidth. I would like to do statistics on network transfers (bandwidth usage, ideally by IP address) in order to rule out foul play (e.g. data exfiltration or flood/DoS attacks).

Is there a way to collect bandwidth data on the KVM/libvirt hypervisor/host side?

The network is currently bridged (without NAT), each VM has its own IP address.

  • Each VM has a vnetX adapter on the host, you can see the ingress/egress counters there – dyasny May 7 at 13:09
  • @dyasny OK, how would I go about getting statistics (more than total bytes sent/received since last boot which I already have)? – Ned64 May 7 at 21:20
  • iftop, nload, nethogs, iptraf, the list goes on and on really – dyasny May 8 at 1:07

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.