Ubuntu 22.04 Network Diagnostic Handbook

This article introduces a complete process for troubleshooting unknown network traffic and bandwidth usage issues in an Ubuntu system. First, use `ip link show` to identify the network interface to be monitored. Then, utilize tools such as `dstat`, `iftop`, and `nload` to monitor overall network traffic and bandwidth usage on specific interfaces in real time. To pinpoint the source of resource consumption, the article recommends using `nethogs` to view traffic by process. It also notes that when a process ID appears as unknown (such as processes inside Docker containers), you should switch to using `tcpdump` to capture and analyze specific network packets. Next, use the `ss` command to check the occupancy status of specific ports, and combine it with the `ps` command to confirm the corresponding process ID and the location of the executable file. Finally, for identified anomalous IP addresses, the article guides you to use `iptables` and `ip6tables` commands to block inbound and outbound traffic. It particularly emphasizes that for IPv6 addresses, since attackers can easily change their addresses, it is recommended to block the entire subnet to enhance defense, thereby helping users effectively diagnose and resolve abnormal network bandwidth issues.