This is a simple utility that allows you to see the load statistics of network interfaces.

You can install VnStat with the following commands:

Debian/Ubuntu

CentOS

yum install vnstat

Done. Moving on. We can configure the information in the utility’s CLI interface by configuring along the way /etc/vnstat.conf.

For example, you can specify a network interface to be listened on by default.

VnStat saves interface statistics databases in/var/lib/vnstat.

With the vnstat -i eth0 command we can see the total statistics (if it has accumulated) on the load of a particular interface or all, unless you specify the parameter.

Replace eth0 with the required network interface.

Available arguments:

• -l — real-time traffic collection.

• -s — summary.

• -t — withdrawal of the ten days in which the load was highest.

• -h — information for the last hour.

• -d — for the last day.

• -w — in the last week.

• -m — in the last month.

For example, if you want to check the current load of your server’s network channel, this command will work. Remember to specify a correct network interface.

vnstat -l -i eth0

Such output allows to determine whether the server is under DDoS-attack. High incoming traffic and a large number of incoming packets do not guarantee that this is the type of attack, but you should definitely pay attention to the protection services from DDoS.