Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have ten servers in two groups servers, and there is a lot of traffic between those groups - too much we think. We know this because of stats of our provider, but don't know how this traffic is built up, and which servers cause this. There is no cluster or failover or anything - each server stands on its own.

I would like to know which server(s) causes this traffic, but don't know how I can monitor this. What program or service can do this? Preferably it could monitor all local network traffic, in 10.x.x.x ip range.

share|improve this question
You must give a try to wireshark – SHW Jul 17 '14 at 10:40
up vote 1 down vote accepted

I use a soft called IPTraf for quick monitoring of network connection. It runs on the terminal and can give you divers stats on the current connections status on the machine it's installed.

enter image description here

you can also get a brake down based on the services used (or ports) which can be useful if your server only serves a particular function. enter image description here

Downside is that you need to install it on each host. I'm no network expert, but if you need to get a wider view of all traffic going between your sites, you would be better to check at the switch/router level with appropriate software.

share|improve this answer
Is it possible to exclude WAN traffic, or monitor only 10.x.x.x traffic? – SPRBRN Jul 17 '14 at 11:48
I haven't used the filtering myself, but take a look here: iptraf.seul.org/2.7/filters.html – fduff Jul 17 '14 at 12:42

iptraf can show you a running tally per-socket so that will tell you which remote hosts are causing all the traffic.

From the main menu go to IP Traffic Monitor and select the interface you want to monitor. Output is fairly intuitive:

enter image description here

share|improve this answer

Wireshark is a must try, as SHW suggested in his comment. It is a networking tool that shows any connections coming in or going out of your network. You can apply a filter to limit your search to your IP address range of your servers, and even track down what protocol is being used(so that you can figure out what is going on). It has a lot more tools that will likely help you in the future if you run into problems that are similar.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.