Measure bandwidth by client IP in realtime

Question

I have been recently attacked using DoS attack on random ports.

I wasn't able to get the attackers IP and now I would like to find it.

What tool can show me bandwidth (in Kbits/Mbits) used by each client IP?

It's dedicated server. I know that I'm under attack because of flow charts in dedi's panel (up to 800 mbps) Thanks for all your replies.

Are you directly connected to the Internet? Are you behind a router? We need a lot more information here. — SpacemanSpiff, Dec 28 '10 at 15:30
Hmmm... You don't have any information on the "attacker" yet you know you were "attacked". How so? — joeqwerty, Dec 28 '10 at 15:35
In addition, how is knowing the client bandwidth going to help you find the culprit? Do legitimate clients not use any bandwidth? — joeqwerty, Dec 28 '10 at 15:40

score 0 · Answer 1 · answered Dec 28 '10 at 15:30

0

You want flow monitoring. See

answered Dec 28 '10 at 15:30

Jeff Ferland

20,547
2
62
85

score 0 · Answer 2 · answered Dec 28 '10 at 15:34

0

Cacti is a pretty good software package for this sort of thing, as is nagios. But as this DoS attack has already occurred, they won't be of much use - they need to be running at the time.

answered Dec 28 '10 at 15:34

atx

1,281
1
9
26

Of course I know. I think it will happen again. – mickula Dec 28 '10 at 16:16

score 0 · Answer 3 · answered Dec 29 '11 at 13:18

0

iftop will show you that information live, though not historically.

answered Dec 29 '11 at 13:18

Bill Weiss

10,979
3
38
66

Measure bandwidth by client IP in realtime

3 Answers3