View traffic in queues

[cr_hyland]

Is there any way to view the actual traffic or IPs in the queues?

We have a need to track down some pretty shocking traffic spikes and the normal queue viewer doesn't give any info other than to say that the LAN queues have hit 8Gb+ and packets are being dropped like crazy.

We'd like to be able to view the actual traffic in the queues and see which IP is generating all the traffic.

[KOM]

Status - Traffic Graph will let you see realtime traffic as a graph, with a table showing top talkers IP address and throughput.  I set mine to Interface: LAN and Display: Hostname to see who is using bandwidth.  Bandwidthd will show you totals for your clients.

[cr_hyland]

I've been using the traffic graphs but it doesn't show the same throughput that the queues see.
It only seems to show the actual throughput after the queues have restricted flow so no help.

I have ntopng installed and have been going through that in detail but the same thing as traffic graphs, ntopng doesn;t seem to show the massive swell of attempted throughput, only the actual throughput..

The other thing i'm wondering is are the queues actually wrong and this traffic is fake or incorrect due to some glitch.
The reason I ask is that i saw it hit 13.6Gb/s once in the queues but we only have 10Gb ethernet so all seemed a bit misleading.

[Harvy66]

I have the opposite issue, the rolling average queue throughput shows me lower values, but "approaches" the current rate.

[cr_hyland]

Well we have that too which was going to be another thread.
Our average queues aren't accurately reflecting the traffic graphs, almost always lower until we have these mad spikes then they are waaaaaay higher that the traffic graphs.

[cr_hyland]

So we are still seeing these random traffic spikes and high queues but are unable to track down the source.

Can anyone suggest a way to track the source of traffic in the queues?

My RRD graphs are attached if it helps.