tracing unknown network traffic

locus84 · 08-03-2012, 10:52 AM

I was investigating a file server's slowness and noticed that about 900Mb/s was being sent from it to another server. I discovered this using iftop.

I then ran nethogs on the destination server and got the following:

0 root unknown TCP 12.445 103423.780 KB/sec

Is there a way I can tell what is generating this traffic?

unSpawn · 08-03-2012, 11:31 AM

Run tcpdump or tshark (with a BPF filter set for only TCP?), store in file, move file to analysis workstation and there run the packet capture through Wireshark?