Recently on some of our sites the bandwidth being used has risen tenfold and we want to know what is using it. All we hav开发者_运维问答e so far is the MRTG graphs that just say 'you used X much at this time'.
I would like to break down this information by service (ftp, http etc), direction (inbound or outbound), source and destination address and when.
To this end I have started logging all the packets through iptables. This seems to give me what I want at a very detailed level. Is there some tool that will take that log file and condense the information in some way.
Ideally it would provide information like:
1.1.1.1 send 123 bytes to 2.2.2.2 via http at 2011-02-24T10:03:17
Any ideas as to how I might achieve this or at least some pointers to making sense of the iptables log format.
A good tool for network analysis is Ethereal Not sure if it will give you what you want exactly, but it will tell you what's going on with your network.
http://www.ethereal.com/
精彩评论