How can I see what is utilizing my localhost interface?

Question

I have a webserver that has almost 4mbps of sustained traffic on the localhost interface. How can I tell what is causing that?

score 2 · Accepted Answer · answered Jul 29 '16 at 17:27

2

Assuming this is a linux system, you can perform a packet capture on your lo interface via something like:

$ sudo tcpdump -i lo

answered Jul 29 '16 at 17:27

EEAA

and if tcpdump isn't available or allowed to be installed, you can insert an iptables rule to log all new connections on `lo`. That will show you the uid/gid. `iptables -I INPUT -i lo -m state --state NEW -m limit --limit 1/s -j LOG --log-prefix="LOOPBACK_LOG: " --log-ip-options --log-level 7` Use `iptables-save|grep LOOP` to see your rule and later delete with `-D` instead of `-I`. This will go to syslog. – Aaron Jul 29 '16 at 19:32

1 Answers1