TCPDUMP Question

seabro · 02-12-2013, 11:18 AM

Hi,

On my LAN, MRTG is showing high utilisation of the Internet link in the upstream direction. In fact it is constantly maxed out at 690kb/s.

I have a tcpdump of the traffic on the WAN port of the switch and my question is, how can I analyse the tcpdump file to find out who is maxing out the upstream link?

We have 8mb/s down and 700kb/s up and down is running at 350kb/s and up is maxed out at 690kb/s.

Any assistance greatly appreciated.

seabro

jlinkels · 02-12-2013, 12:00 PM

I don't think TCPdump is the right tool for that. jnettop shows traffic sorted by bitrate and usually proves me useful for these kind of mysteries. Once you know which host/port causes the traffic, TCPdump comes into picture to analyse the data itself if it is still a mystery.

There are other similar tools like jnettop in case you can't install that.

jlinkels

unSpawn · 02-12-2013, 12:12 PM

There's a few command line tools that may help like tcpflow, tcptrace, tcpstat (output example), etc, etc but if you're familiar with Wireshark it's good to know it can show a packet capture breakdown (menu > statistics > protocol hierarchy) so you can see if the majority is TCP or UDP or something else, what remote ports are used, etc ,etc. Apply a filter for the protocol and remote port (example: tcp.port == 20) and you'll see what the LAN source IP is.