How find out what or who is using my bandwidth?

For immediate monitoring you can use iftop. This will show you the currently active connections and the bandwidth they are using. Once you've identified a high traffic connection, find the local port number and use netstat to find which process the connection belongs to.

sudo netstat -tpn | grep 12345

For longer term monitoring I would suggest something like darkstat. This can give you a breakdown per host and port which might allow you to figure out what the traffic is related to.


I'd recommend installing ntop.

http://www.ntop.org/

Put that on a host gateway/router location and watch traffic for a day/week. Ntop provides a web UI where you can get a breakdown by IP/port/protocol.