Background: one of our Ubuntu servers is becoming randomly (?) unresponsive ie. some connections are dropped and the server is not accepting new ones for a while. At least this is what we see in logs of dependant services. The problem lasts for few minutes at best. It happens 1-3 times a day. We use munin to monitor this server, but nothing from standard graphs stands out for us.
After initial diagnosis nothing came up but our data center told us that when it happens there are short high spikes of traffic on their charts. No more useful info from them. How to identify what is causing them? (source IP, dest port)
I thought about capturing packets with tcpdump, but I have no idea what filter could be applied to avoid producing gigabytes of logs. Maybe there exist a tool to log all connections and print statistics (connection duration, bytes exchanged, rate)? Assuming these are not connectionless packets.