Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Is there software I can install to enable me to monitor inbound and outbound internet traffic for security reasons?

I recently installed ubuntu and loving it because of speed and interface. I want to do what I can to make this the greatest OS I've ever worked with. Can you provide suggestions as to what I should install or do?

share|improve this question
    
Hi @gijoemike and welcome to Ask Ubuntu! We find on here that it works best if you keep can keep it to one specific question per question. For this reason I've edited your question to only ask about the traffic monitoring issue. We'd love it if you opened a new question to ask about the changes to your files. –  8128 Nov 13 '10 at 21:07

9 Answers 9

I personally use vnstat which works quite nicely as it just sits in the background. You can query it for hourly, daily, monthy stats and there's a nice web based frontend to it called jvnstat.

Here's some examples from my website:-

alan@bishop:~$ vnstat -m

eth0  /  monthly

   month        rx      |     tx      |    total    |   avg. rate
------------------------+-------------+-------------+---------------
  Dec '09     10.05 GiB |   38.33 GiB |   48.38 GiB |  151.54 kbit/s
  Jan '10     10.83 GiB |   50.71 GiB |   61.55 GiB |  192.76 kbit/s
  Feb '10      8.18 GiB |   63.24 GiB |   71.42 GiB |  247.65 kbit/s
  Mar '10     10.43 GiB |   93.92 GiB |  104.35 GiB |  326.83 kbit/s
  Apr '10     12.56 GiB |   85.59 GiB |   98.15 GiB |  317.63 kbit/s
  May '10     12.70 GiB |   94.37 GiB |  107.07 GiB |  335.35 kbit/s
  Jun '10     17.02 GiB |   95.04 GiB |  112.06 GiB |  362.66 kbit/s
  Jul '10     33.18 GiB |  177.08 GiB |  210.26 GiB |  658.52 kbit/s
  Aug '10     25.52 GiB |   37.25 GiB |   62.77 GiB |  196.60 kbit/s
  Sep '10     20.70 GiB |   55.09 GiB |   75.79 GiB |  245.29 kbit/s
  Oct '10     16.96 GiB |   60.15 GiB |   77.12 GiB |  241.52 kbit/s
  Nov '10     23.97 GiB |   72.45 GiB |   96.41 GiB |  502.29 kbit/s
------------------------+-------------+-------------+---------------
estimated     38.58 GiB |  116.62 GiB |  155.20 GiB |

alan@bishop:~$ vnstat -h
eth0                                                                     15:16
 ^                                                                  t
 |                                                                  t
 |                                                                  t
 |                                                            t    rt
 |      t                                                    rt    rt
 |      t              t                                     rt    rt
 |      t              t                                   t rt rt rt  t
 |      t     t  t  t  t     t     t     t                 t rt rt rt  t
 |     rt     t  t  t  t     t     t     t              t rt rt rt rt rt
 |  rt rt rt rt rt rt rt r  rt rt rt r  rt r  r  r  r  rt rt rt rt rt rt
-+--------------------------------------------------------------------------->
 |  16 17 18 19 20 21 22 23 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15

 h  rx (KiB)   tx (KiB)      h  rx (KiB)   tx (KiB)      h  rx (KiB)   tx (KiB)
16      37374      32892    00      28233      90548    08      29588      18472
17      55325     148496    01      27162      32413    09      44442      48771
18      37293      23266    02      23543      75628    10      60487     111111
19      28184      79542    03      26526       9882    11     143143     177348
20      27952      75414    04      28217      76025    12     108370     100327
21      28963      78342    05      26732       9255    13     173459     227965
22      29337     118592    06      26586      13474    14      48390     110247
23      27454      15529    07      26874      11389    15      10813       8882

vnstat is in the repositories and takes just a moment to setup. There's a nice guide on the debian administration website:-

http://www.debian-administration.org/articles/330

share|improve this answer
2  
Cute little ASCII graphic :) –  iuliux Jan 5 '13 at 18:26

Network analyser tools:

share|improve this answer

I suggest you to install iptraf commandline tool.

share|improve this answer

That is a question requiring a very nontrivial answer. The following tools could all be useful to deflect an attack:

nmap -A
netstat -lnptu
kill
the /proc filesystem 
iptables
the sentry tools suite

These tools give you a lot of control if you know how to use them and will require some good "hobby time" to learn.

share|improve this answer

If your only interessted in how much traffic there is (not its destination) you could use a commandline tool called bmon.

share|improve this answer
1  
I think bmon only shows real-time statistics –  iuliux Jan 5 '13 at 18:28

Here is list of tools you can use

share|improve this answer
    
Linking to other websites is not a valid answer. Nothing worse than heading down the rabbit hole. Plus if your website goes offline your answer becomes invalid. Better to post actual answers and then link to the source. –  Phil Hannent Nov 20 '10 at 8:35

As far as your first question is concerned you can use wireshark network analyser to monitor traffic on your network interfaces. some tutorials are here

http://www.wireshark.org/docs/

share|improve this answer

Cacti

Cacti is a complete network graphing solution designed to harness the power of RRDTool's data storage and graphing functionality. Cacti provides a fast poller, advanced graph templating, multiple data acquisition methods, and user management features out of the box. All of this is wrapped in an intuitive, easy to use interface that makes sense for LAN-sized installations up to complex networks with hundreds of devices.

enter image description here

Installation:

sudo apt-get install cacti

Click this to read about Cacti features

share|improve this answer

Bandwidthd

BandwidthD tracks usage of TCP/IP network subnets and builds html files with graphs to display utilization. Charts are built by individual IPs, and by default display utilization over 2 day, 8 day, 40 day, and 400 day periods. Furthermore, each ip address's utilization can be logged out at intervals of 3.3 minutes, 10 minutes, 1 hour or 12 hours in cdf format, or to a backend database server. HTTP, TCP, UDP, ICMP, VPN, and P2P traffic are color coded.

enter image description here

Download from here.

Read more about here

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.