Michael Lindner <michael@tropyx.com> wrote:

Wireshark FTW! One way is to run Snort on the server and use WS to analyse the output.

Or tshark if you want to run it on the server, using a read filter (the -R option, see wireshark-filter)5) for details) to filter out traffic that you regard as legitimate. Even just running it for a minute or so and looking at the output might be enough to identify the offending protocol. I'm not the right person to ask if you need help with the filter language; I've only used it occasionally with relatively simple filter expressions.

On 20/11/12 09:35, Trent W. Buck wrote:

IME best practice is to put tcpdump on your router, run tcpdump -wfoo.pcap

You want to add -s0 to that if you want to capture the whole packet (tshark does that automatically). cheers, Chris -- Chris Samuel : http://www.csamuel.org/ : Melbourne, VIC

On 20 November 2012 12:58, DanyJ <dan062@yahoo.com.au> wrote:

It is a hosted Xen VM - not a physical server. and no X, ie: all gui option are out..

That is why you capture the packets on the server and copy the file to another computer that is running X. (or you can run ssh with X forwarding also) -- Brian May <brian@microcomaustralia.com.au>

On 20/11/12 13:11, Chris Samuel wrote:

Neither tshark not tcpdump require a GUI.

s/not/nor/ -- Chris Samuel : http://www.csamuel.org/ : Melbourne, VIC

On 19 November 2012 18:18, Andrew Spiers <andrew@andrewspiers.net> wrote:

I think iotop is more for disk io than network. For live per-process network monitoring I like the nethogs program.

Sorry - I got confused - jnetop Description-en: View hosts/ports taking up the most network traffic jNettop captures traffic coming across the host it is running on and displays streams sorted by bandwidth they use. Result is a nice listing of communication on network by host and port, how many bytes went through this transport and the bandwidth it is consuming. .... It does require all your traffic goes through your PC Andrew

Jason White <jason@jasonjgw.net> wrote:

It should be possible to install it on an OpenWRT or similar router however, and it may already have been packaged for that environment.

Actually, no, it wouldn't be useful on a router - it seems to require that the processes it identifies originate the packets. It doesn't do packet capture as far as I can tell from the description.

On 19/11/12 17:57, Andrew Worsley wrote:

For a quick hit on the top ten you can try iotop package (in debian at least)

I think you mean iftop.. :-) -- Chris Samuel : http://www.csamuel.org/ : Melbourne, VIC

DanyJ <dan062@yahoo.com.au> writes:

I have run tshark and downloaded the capture file. I am reading the capture file using wireshark. I see a lot of the following showing:

18 1.047790 111.67.22.211 111.67.23.255 DB-LSP-DISC 153 Dropbox LAN sync Discovery Protocol

What are these? There is not Dropbox on the server. Any one can help please?

From context, I'm guessing that dropbox spams the LAN to find other dropbox users. Thus, someone else on your LAN is running dropbox.

IIRC dropbox showed up in my squid logs attempting to do crazy made-up HTTP verbs, too. I get the impression they're pretty cowboy.

Hi All Thanks for all help. I think I worked out what the problem was with tshark and wireshark. For info: I would appear that the increase in traffic was due to a broken dovecot-imap-thunderbird 16.0.2 interaction. When left open, thunderbird was synching up to several 100's Mb of email from server to client hourly - it had been set to synch every 10 mins - but instead of only checking new headers it was downloading every email message. It was set to locally cache messages. Plus other legimate traffic it was adding up to ~3 Gb of upload traffic daily - which was way more than I had expected. There are related bugs reported on the thunderbird website. I had recenly upgraded t/bird, so its a regression. There are posts relating to dovecot and t/bird. I am not sure if it also applies to other imap servers or only dovecot-t/bird combination. Seems to have been fixed in latest T/bird 17 beta which I am using now. Cheers Daniel. On Tue, 20 Nov 2012 15:57:42 +1100 DanyJ <dan062@yahoo.com.au> wrote:

Hello

I have run tshark and downloaded the capture file. I am reading the capture file using wireshark

I see a lot of the following showing:

18 1.047790 111.67.22.211 111.67.23.255 DB-LSP-DISC 153 Dropbox LAN sync Discovery Protocol

What are these? There is not Dropbox on the server. Any one can help please?

Cheers Daniel.

...

Hello LUVers

I have been experiencing an increase of about 5x factor in my outgoing network traffic for a while -at least last week - I cannot explain that change in activity,configuration etc... (It does peak to much higher level at a specific time, but I have worked out why that was so.. a overgrown backup file that was being transfered daily)

So I need to find out what that traffic is.

What is a recommended log analysers to help me quickly here? Want it to tell me how much data is being transfered by which protocol

Or any recommended procedure to identify that traffic?

Any ideas please?

Its a Ubuntu 10.04 server, running Apache, Postfix and related stuff (Spamassassin, Amavisd etc) (I had varnish on it, but I turned it off)

Cheers Daniel. _______________________________________________ luv-main mailing list luv-main@luv.asn.au http://lists.luv.asn.au/listinfo/luv-main

_______________________________________________ luv-main mailing list luv-main@luv.asn.au http://lists.luv.asn.au/listinfo/luv-main