tracking down network load?

Dan Nelson dnelson at allantgroup.com
Mon May 23 12:35:26 PDT 2005


In the last episode (May 23), Louis LeBlanc said:
> I have a strange question.  Well, maybe not so strange.
> 
> I am working on my 5.3 RELEASE system, and I notice my network
> monitor on gkrellm is showing unexplained loads (15/23Kbps sustained)
> in traffic on the external interface.
> 
> I'm not too concerned that this is a security breach, but I do notice
> at least one ESTABLISHED connection that I can't explain (it goes
> back to AOL, which naturally sows a little mistrust).
> 
> Anyway, how to I find the actual process (server or otherwise) on my
> end that is handling a given connection, and what kind of load it is
> handling?

sockstat or "lsof -i" will tell you which sockets belong to which
processes, and tcpdump or any of a dozen or so programs in ports will
give you detailed network usage.  Start with trafshow and iftop.

-- 
	Dan Nelson
	dnelson at allantgroup.com


More information about the freebsd-questions mailing list