Linux – How find out what or who is using the bandwidth

linuxUbuntu

To be honest, I'm poor at server administration, but my boss asked me for help.
His server has a limited bandwidth of 2GB/day and today he received warning from company that he exceeded it and used… 24GB.

As it is impossible cause he was way, he asked me if I can track down the problem. I have no idea where to start or what to do.

Any information would be helpful how can I find out whats wrong.

Machine is running on Ubuntu 12.04. The most curious thing is that, according to diagrams received from hoster, only outgoing transfer was used.

EDIT

Thanks for suggestions, i'll run tcpdump and try to examine the result

Best Answer

For immediate monitoring you can use iftop. This will show you the currently active connections and the bandwidth they are using. Once you've identified a high traffic connection, find the local port number and use netstat to find which process the connection belongs to.

sudo netstat -tpn | grep 12345

For longer term monitoring I would suggest something like darkstat. This can give you a breakdown per host and port which might allow you to figure out what the traffic is related to.