I run a web server (Debian Squeeze on a VPS), and the graphs provided by the hosting company show consistently that around twice as much traffic is incoming to the server compared to the outgoing traffic. I am a little confused by this, so I would like to run some kind of logging utility on the machine that will not only confirm the upload/download figures, but also split them up by the remote host involved, so I can see if a large proportion of the incoming traffic is from one particular source.
I suspect most of the outgoing traffic goes through Apache, but the incoming traffic may be mostly through Apache or could be dominated by other scripts and cron jobs, so I would prefer a tool that would monitor traffic at the interface level rather than something within Apache.
Ideally I would like a tool that I can leave running for a few days, then come back and get an output of "bytes per remote host" for both incoming and outgoing traffic.
Is this possible with a standard Linux tool and a bit of configuration (if so, how?) or with a specialist program (if so, which?)