6

There are plenty of ways to monitor traffic on a specific interface or even by port. But if I am on a router and suspect one of the workstations is using more bandwidth then others, how to check?

3 Answers 3

4

iftop will show the TCP/UDP streams on an interface in realtime, which is often sufficient to identify which host is hogging the bandwidth. If you want something to record this over time, try darkstat or bandwidthd.

2
  • Thank you, any way to monitor across multiple interfaces? either with iftop or similar?
    – Alex
    Jun 12, 2012 at 3:44
  • Looks like you have to run an iftop per interface.
    – mgorven
    Jun 12, 2012 at 4:19
2

iftop can do this and it's easily apt-get'able:

             191Mb      381Mb                 572Mb       763Mb             954Mb     
└────────────┴──────────┴─────────────────────┴───────────┴──────────────────────
box4.local            => box-2.local                      91.0Mb  27.0Mb  15.1Mb
                      <=                                  1.59Mb   761kb   452kb
box4.local            => box.local                         560b   26.8kb  27.7kb
                      <=                                   880b   31.3kb  32.1kb
box4.local            => userify.com                         0b   11.4kb  8.01kb
                      <=                                  1.17kb  2.39kb  1.75kb
box4.local            => b.resolvers.Level3.net              0b     58b    168b
                      <=                                     0b     83b    288b
box4.local            => stackoverflow.com                   0b     42b     21b
                      <=                                     0b     42b     21b
box4.local            => 224.0.0.251                         0b      0b    179b
                      <=                                     0b      0b      0b
224.0.0.251           => box-2.local                         0b      0b      0b
                      <=                                     0b      0b     36b
224.0.0.251           => box.local                           0b      0b      0b
                      <=                                     0b      0b     35b


─────────────────────────────────────────────────────────────────────────────────
TX:           cum:   37.9MB   peak:   91.0Mb     rates:   91.0Mb  27.1Mb  15.2Mb
RX:                  1.19MB           1.89Mb              1.59Mb   795kb   486kb
TOTAL:               39.1MB           92.6Mb              92.6Mb  27.9Mb  15.6Mb

nload is another great tool for monitoring bandwidth in real time, also in the repos, but can't sort by specific destination IP:

Device eth0 [10.10.10.5] (1/2):
=====================================================================================
Incoming:


                               .         ...|    
                               #         ####|   
                           .. |#|  ...   #####.         ..          Curr: 2.07 MBit/s
                          ###.###  #### #######|.     . ##      |   Avg: 1.41 MBit/s
                         ########|#########################.   ###  Min: 1.12 kBit/s
             ........    ###################################  .###  Max: 4.49 MBit/s
           .##########. |###################################|#####  Ttl: 1.94 GByte
Outgoing:
            ##########  ###########    ###########################
            ##########  ###########    ###########################
            ##########. ###########   .###########################
            ########### ###########  #############################
            ########### ###########..#############################
           ############ ##########################################
           ############ ##########################################
           ############ ##########################################  Curr: 63.88 MBit/s
           ############ ##########################################  Avg: 32.04 MBit/s
           ############ ##########################################  Min: 0.00 Bit/s
           ############ ##########################################  Max: 93.23 MBit/s
         ############## ##########################################  Ttl: 2.49 GByte

For automated usage, don't forget about the classic sar and netstat on older *nix and combining with cut, grep, and awk.

-1

Try using something like Wireshark and filtering the IP's to the workstation's specific IP. You can see how much data is on the network that has originated from that machine. If its flooding the network with traffic then you will see on Wireshark.

Wireshark does come with command line tools if you don't have a X server on your Linux router. Its not the most elegant solution but it will get it down and tell you exactly how much data its sending.

Bill

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .