Solaris

I have system which is using a lot of bandwidth and this is not a big problem,
but how do you troubleshoot this issue?
How can I find out which connections are made for one interface card,
there are about 5 on this system and I can see how much traffic is going through one interface, but I need to drill down more.

Thx.

The dtrace toolkit is your friend in such circumstances. Download the dtrace tookkit (DTK) and use one or more of the networking-related scripts such as:

Code:

tcpsnoop
tcptop
udpsnoop.d
connections

thx, but the company has strict security policy and we can't install these tools, we need to use the standard OS tools

Those tools are just DTrace scripts, which is standard OS tool. If you were fluent enough in DTrace you could write them yourself, but why do it, if it has already been done?

DTrace is part of the Solaris 10 distribution, you already have it. You may also have some other DTrace script to do what you want. look in /usr/demo/dtrace. google for brandan gregg, his site has some good information. You can certainly transcribe D code to your box without violating security - most of it has less than 20 lines of code anyway.

Have you tried:

dladm show-dev -s -i 1

That will tell you traffic per interface.. Other than that if you want to know which process is going through which interface then you can script that... shouldn't be that difficult.

1- Get the output from netstat -an|grep STABLISHED take the destination hostname column
2- run route get <ip> for each connection
3- get the interface for each route get and count.
4- Based on the port it uses you can determine which application is it. IF it is a well known port like 22 then that's it, if not you can use lsof as well.

And voila... you have your own statistic. Is quiet a bit of scripting but if you can't install external tools I think that's your only option.

Juan