I run a web server (Debian Squeeze on a VPS), and the graphs provided by the hosting company show consistently that around twice as much traffic is incoming to the server compared to the outgoing traffic. I am a little confused by this, so I would like to run some kind of logging utility on the machine that will not only confirm the upload/download figures, but also split them up by the remote host involved, so I can see if a large proportion of the incoming traffic is from one particular source.

I suspect most of the outgoing traffic goes through Apache, but the incoming traffic may be mostly through Apache or could be dominated by other scripts and cron jobs, so I would prefer a tool that would monitor traffic at the interface level rather than something within Apache.

Ideally I would like a tool that I can leave running for a few days, then come back and get an output of "bytes per remote host" for both incoming and outgoing traffic.

Is this possible with a standard Linux tool and a bit of configuration (if so, how?) or with a specialist program (if so, which?)


ntop is probably your best solution for doing this. It is designed to run long term and capture exactly what youre looking for.
It can show you what remote destinations are being used the most, how much traffic sent to/from, what protocols and ports were being used etc. It can do the same for the source hosts if you run it on a router so you can see the same stats on local clients as well.
It then uses a web GUI to navigate and display this information.


  • Whoa. All these years I've been using ntop just like top, I had no idea it had a daemon mode and a built-in web interface! There's nothing at all wrong with @ckhan's suggestion, but I'll accept this one as I feel ntop's built-in web interface is easier to use than tcpdump followed by Wireshark. – Ian Renton Apr 23 '12 at 19:42

If you have root, you could just use tcpdump and grab everything. You can then pull it up in Wireshark and analyze to your heart's content.

$ sudo tcpdump -i <interface> -w mycapture.tcpdump  

... and then hit ctrl-c when you've had enough. Run in a screen session if you need to detatch, etc.

By default, it'll only capture the first part of each packet, but since you're mostly interested in origin analysis that should be fine. Tons of other options to tcpdump if you're feeling adventurous.

EDIT: In fact, once loaded into Wireshark, you can just use the menu option Statistics | IP Addresses... and get a nice summary of traffic by count/rate/percent:

enter image description here

  • Thanks, that seems like a reasonable way to go. Do you know if Wireshark can automatically produce the kind of output I'm after (e.g. "1000 connections to serverA, 967 connections to serverB...") or would I have to write a script to build up that information from the TCP dump myself? – Ian Renton Apr 18 '12 at 5:36
  • @IanRenton - I think it'll do exactly what you want, see edited answer. I believe tcpdump can also spit out packet summaries that you could readily grep, wc, etc. – ckhan Apr 18 '12 at 9:04

And for a more advanced metrics you can use something like monitorix which have modules for most common services and it's just a simple:

apt-get install monitorix

Also you have cacti an complete GUI RDDtool, but not real time.

And in the top 1 for me it's the multi-configurable grafana. Its a little bit more difficult to install & configure but it's just perfect, you can measure everything in detail and real-real-time. It needs some dependencies JVM,graphite, whisper,... some knowledge about JSON, but works like a charm I really recommend it!

Maybe a good config for your case should be:

collectd + graphite + whisper + grafana

Actually grafana changed my life in the office.

  • Whisper brings up a lot of hits, none of which seems relevant. Except some firewall for Android... Could you give an url? Maybe you have a github repo with your setup. – oligofren Dec 13 '15 at 22:34

sure ;)


Also if you want a mini-howto for how to connect everything: https://linuxboss.wordpress.com/2015/12/03/graphite-grafana/

  • 1
    Hello Peter K - welcome to U&L! We prefer to integrate the answers from links so that the answer stays releveant even if the external web page moves or gets deleted. Can you provide more information as an answer? – Jeff Schaller Jan 4 '16 at 12:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.