What's using up bandwidth?

[Bill Moseley <moseley@hank.org>]

Here's an admin question:

I've got a home LAN connected via DSL.  Every once in a while the DSL
modem will indicate the connection is saturated.

How would you go about tracking down the process that is eating up all
the bandwidth?

First, need to find out which machine the process is running on.

netstat -p on the NAT machine doesn't show the connections for the NAT'ed
machines.  They can be seen with /proc/net/ip_conntrack, but that
doesn't offer any help with regard with where the bulk of the packets
are coming from.

Once you find the machine how do you figure out what process is
generating all the traffic?  Once I know the ip/port I can use lsof to
find out which process has that port open.

If I could list bytes transferred per port that would help a lot in
finding the process.

How would you go about this task?

All this would seem like a reasonably common sysadmin task -- so are
there any better tools to use?


-- 
Bill Moseley
moseley@hank.org