some times we receive volumetric traffic from single source IP (out of our networks) towards one destination in our network, is there anyway to find it with tcp dump ? thank you.
You can not display the source of the highest traffic volume/packet count using only
tcpdump. Although it can be done by pairing
tcpdump with additional tools, it is not optimal for your use case. (One way to do this would be through ssh tunneling the capture data from tcpdump to your local system, and analyzing the captured data with a tool such as Wireshark)
I would follow Ron's suggestion, and use a flow analysis protocol for this job. If your networking equipment does not support exporting NetFlow or IPFIX, you could look into setting up a
softflowd probe along the ingress path or on the destination system itself. This probe would export the flow data to a collector, which can save it for later analysis.
For the collector you can use
nfcapd the tool is capable of collecting NetFlow and IPFIX flow data, it generally comes bundled with the
nfdump tool is capable of printing out sorted output from the captured flows fitting to your requirements.
Example to list flows exceeding 100M of traffic volume with a set destination network:
nfdump -R /path/saved/flows/ -s dstip/bytes -L +100M 'dst net 172.16.0.0/24'
For a simple setup guide of
nfdump see here.
traffic from single source IP (out of our networks) towards one destination in our network
Since that traffic crosses your firewall, you should count traffic there. Alternatively, you should use sFlow or NetFlow to monitor the firewall's LAN-facing port or its switch port for traffic, possibly already filtered for the destination.
As Yevhen has already pointed out, tcpdump/packet capturing isn't an efficient tool for this job.