Server traffic Anomaly Troubleshooting step (view process traffic)

In the work often encounter server traffic anomalies, from time to moment the traffic is very high, today is a server intranet port traffic has reached 50Mbps within a short period, below is my method and steps to troubleshoot the problem, record.

1. Use Iftop-p to determine which process has a larger flow rate

Or use Iptraf,jnettop Ask the reader to do their own research

It can be seen that the api-node3:58218 process flows most. The next step is to determine the corresponding process PID based on the port number

2. Determine the application process PID corresponding to the port number

# lsof-i:58218 or NETSTAT-ATUNP |grep 58218

The PID was confirmed to be 25701. The next step is to determine which process depends on the PID

3. Determine the process name

Determine the name of the process based on the process PID

# Cat/proc/25701/cmdline

From for notes (Wiz)

Server traffic Anomaly Troubleshooting step (view process traffic)