Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I run a web server (Debian Squeeze on a VPS), and the graphs provided by the hosting company show consistently that around twice as much traffic is incoming to the server compared to the outgoing traffic. I am a little confused by this, so I would like to run some kind of logging utility on the machine that will not only confirm the upload/download figures, but also split them up by the remote host involved, so I can see if a large proportion of the incoming traffic is from one particular source.

I suspect most of the outgoing traffic goes through Apache, but the incoming traffic may be mostly through Apache or could be dominated by other scripts and cron jobs, so I would prefer a tool that would monitor traffic at the interface level rather than something within Apache.

Ideally I would like a tool that I can leave running for a few days, then come back and get an output of "bytes per remote host" for both incoming and outgoing traffic.

Is this possible with a standard Linux tool and a bit of configuration (if so, how?) or with a specialist program (if so, which?)

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

ntop is probably your best solution for doing this. It is designed to run long term and capture exactly what youre looking for.
It can show you what remote destinations are being used the most, how much traffic sent to/from, what protocols and ports were being used etc. It can do the same for the source hosts if you run it on a router so you can see the same stats on local clients as well.
It then uses a web GUI to navigate and display this information.


share|improve this answer
+1. Ntop is exactly the right solution. –  bahamat Apr 18 '12 at 23:42
Whoa. All these years I've been using ntop just like top, I had no idea it had a daemon mode and a built-in web interface! There's nothing at all wrong with @ckhan's suggestion, but I'll accept this one as I feel ntop's built-in web interface is easier to use than tcpdump followed by Wireshark. –  Ian Renton Apr 23 '12 at 19:42
add comment

If you have root, you could just use tcpdump and grab everything. You can then pull it up in Wireshark and analyze to your heart's content.

$ sudo tcpdump -i <interface> -w mycapture.tcpdump  

... and then hit ctrl-c when you've had enough. Run in a screen session if you need to detatch, etc.

By default, it'll only capture the first part of each packet, but since you're mostly interested in origin analysis that should be fine. Tons of other options to tcpdump if you're feeling adventurous.

EDIT: In fact, once loaded into Wireshark, you can just use the menu option Statistics | IP Addresses... and get a nice summary of traffic by count/rate/percent:

enter image description here

share|improve this answer
Thanks, that seems like a reasonable way to go. Do you know if Wireshark can automatically produce the kind of output I'm after (e.g. "1000 connections to serverA, 967 connections to serverB...") or would I have to write a script to build up that information from the TCP dump myself? –  Ian Renton Apr 18 '12 at 5:36
@IanRenton - I think it'll do exactly what you want, see edited answer. I believe tcpdump can also spit out packet summaries that you could readily grep, wc, etc. –  ckhan Apr 18 '12 at 9:04
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.