Finding out where the bandwidth is being used

Recently on some of our sites the bandwidth being used has risen tenfold and we want to know what is using it. All we hav开发者_运维问答e so far is the MRTG graphs that just say 'you used X much at this time'.

I would like to break down this information by service (ftp, http etc), direction (inbound or outbound), source and destination address and when.

To this end I have started logging all the packets through iptables. This seems to give me what I want at a very detailed level. Is there some tool that will take that log file and condense the information in some way.

Ideally it would provide information like:

1.1.1.1 send 123 bytes to 2.2.2.2 via http at 2011-02-24T10:03:17

Any ideas as to how I might achieve this or at least some pointers to making sense of the iptables log format.

A good tool for network analysis is Ethereal Not sure if it will give you what you want exactly, but it will tell you what's going on with your network.

http://www.ethereal.com/