I often find myself needing a simple tool to diagnose TCP and UDP connection issues in real time. While tcpdump is an excellent tool for debugging issues at the packet level, a higher level tool is often better to diagnose network flow and bandwidth utilization. There are two that I have found that work very well for this type of debugging.
The first is IPTraf which is a IP LAN monitor that generates various network statistics including TCP info, UDP counts, ICMP and OSPF information, Ethernet load info, and IP checksum errors. IPTraf is part of the Centos distribution can be installed on any Centos 5 server via yum:
yum install iptraf
Once installed, executing IPTraf from the command line will launch an ascii based menu system that will allow you to view IP traffic counts, detailed interface statistics, and protocol breakdowns per physical interface.
The second tool that I really like is Iftop which is part of EPEL and can be installed via yum on Centos based systems:
yum install iftop
Once installed, executing iftop launches a single page that shows all active network flows on the system. Once nice feature of iftop is each flow Is represented as a bargraph relative to each flow’s utilization. This allows you to quickly identify a connection using a large amount of bandwidth.
These tools are very useful to provide you a glimpse into what types of traffic are flowing right now. I use these tools often to look at a server’s current bandwidth utilization, top flows by source and destination, and protocol breakdowns.