analyzing network traffic

guttersnipe · 04-11-2008, 04:26 PM

Is there a standard linux command that can be used to analyze network traffic coming in and out of your computer?

I am looking for something similar to "top," but for network traffic instead of processor/memory usage.

mpier · 04-11-2008, 04:34 PM

Maybe iptraf?

guttersnipe · 04-12-2008, 02:58 AM

That application is really great, but it isn't quite what I need.

Is there a way that I can get the functionality of iptraf specific to each process running?

salasi · 04-12-2008, 04:22 AM

Quote:

Originally Posted by guttersnipe

I am looking for something similar to "top," but for network traffic instead of processor/memory usage.

Something 'similar to top but for network traffic' is 'ntop'. (The cunning disguise is in the name :-) )

Don't know whether it does exactly what you want, but I'd bet the man page does.

froggy060768 · 04-12-2008, 09:02 AM

another great tool where you can analyze multiple things like you network traffic and so on is nmon.

Look here for a nice wiki for this tool:

http://www-941.ibm.com/collaboration...nmon+for+Linux

sri_ram1982 · 04-12-2008, 10:40 AM

you can use netstat -a or tcpdump to analyze network traffic.

guttersnipe · 04-13-2008, 03:41 PM

Code:

ntop

This really is a great program. It gives a beautiful overview of all your traffic in pretty rrd graphs from a user-friendly web browser over port 3000. That being said, the name is misleading. It displays similar to top in that it sorts based on the most demanding resource. While top sorts by each process, ntop sorts by each host. Again, this isn't what I need.

Code:

nmon

Another great tool, but--again--it only shows the traffic coming in and out. It does not record which PROCESS is using that traffic.

Code:

netstat -a

and

Code:

tcpdump

Were not quite what I was looking for, but they sure provide a TON of useful information!

What I'm looking for is something that sorts based on process ids. I need to know which PROCESS is chewing up x amount of bandwidth at any given time. This is different from the results of applications like ntop because a single process (such as azureus--a bittorrent client, for example) can simultaneously connect to multiple, external hosts.

Does such a program exist?

chickenlinux · 04-13-2008, 05:56 PM

Perhaps there is a wireshark branch...?