1

some times we receive volumetric traffic from single source IP (out of our networks) towards one destination in our network, is there anyway to find it with tcp dump ? thank you.

  • 4
    You need to use something like NetFlow for that. Use the correct tool for the job. – Ron Maupin Jun 30 at 15:15
1

You can not display the source of the highest traffic volume/packet count using only tcpdump. Although it can be done by pairing tcpdump with additional tools, it is not optimal for your use case. (One way to do this would be through ssh tunneling the capture data from tcpdump to your local system, and analyzing the captured data with a tool such as Wireshark)

I would follow Ron's suggestion, and use a flow analysis protocol for this job. If your networking equipment does not support exporting NetFlow or IPFIX, you could look into setting up a softflowd probe along the ingress path or on the destination system itself. This probe would export the flow data to a collector, which can save it for later analysis.

For the collector you can use nfcapd the tool is capable of collecting NetFlow and IPFIX flow data, it generally comes bundled with the nfdump package.

The nfdump tool is capable of printing out sorted output from the captured flows fitting to your requirements.

Example to list flows exceeding 100M of traffic volume with a set destination network:

nfdump -R /path/saved/flows/ -s dstip/bytes -L +100M 'dst net 172.16.0.0/24'

For a simple setup guide of softflowd and nfdump see here.

| improve this answer | |
0

traffic from single source IP (out of our networks) towards one destination in our network

Since that traffic crosses your firewall, you should count traffic there. Alternatively, you should use sFlow or NetFlow to monitor the firewall's LAN-facing port or its switch port for traffic, possibly already filtered for the destination.

As Yevhen has already pointed out, tcpdump/packet capturing isn't an efficient tool for this job.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.