I run a web server (Debian Squeeze on a VPS), and the graphs provided by the hosting company show consistently that around twice as much traffic is incoming to the server compared to the outgoing traffic.  I am a little confused by this, so I would like to run some kind of logging utility on the machine that will not only confirm the upload/download figures, but also split them up by the remote host involved, so I can see if a large proportion of the incoming traffic is from one particular source.I suspect most of the outgoing traffic goes through Apache, but the incoming traffic may be mostly through Apache or could be dominated by other scripts and cron jobs, so I would prefer a tool that would monitor traffic at the interface level rather than something within Apache.Ideally I would like a tool that I can leave running for a few days, then come back and get an output of bytes per remote host for both incoming and outgoing traffic.Is this possible with a standard Linux tool and a bit of configuration (if so, how?) or with a specialist program (if so, which?)
What can I use to monitor and log incoming/outgoing traffic to/from remote hosts?
debian;networking;logs;monitoring;webserver
ntop is probably your best solution for doing this. It is designed to run long term and capture exactly what youre looking for.It can show you what remote destinations are being used the most, how much traffic sent to/from, what protocols and ports were being used etc. It can do the same for the source hosts if you run it on a router so you can see the same stats on local clients as well.It then uses a web GUI to navigate and display this information.