# Finding source of \*massive Traffic\*

**URL:** <https://forums.percona.com/t/finding-source-of-massive-traffic/3836>\
**Category:** Other MySQL® Questions\
**Created:** [October 20, 2014, 7:18am UTC](https://forums.percona.com/t/finding-source-of-massive-traffic/3836 "2014-10-20T07:18:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Futureweb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/futureweb/32/1034_2.png) [@Futureweb](https://forums.percona.com/u/Futureweb)\
**Post date:** [October 20, 2014, 7:18am UTC](https://forums.percona.com/t/finding-source-of-massive-traffic/3836/1 "2014-10-20T07:18:52Z")

</div>

Hello,

I got a little Problem here … Scenario:  
Server 1: HTTP Server where our CMS is  
Server 2: MySQL Server of the CMS

Sometimes (a few Times a Week) we got MASSIVE Traffic Spikes between those 2 Servers. (200-300 MBit for 1-2 Minutes) and I’m unable to find the Source of those massive Traffic Spikes … My guess is that there is a Bogus-Query which fetches a very Big Resultset … but I was not able to find such a Query. (Not to wonder with xxx.xxx Queries within the CMS …)  
Already tried it with the Slow-Query-Log, with Peak Memory Monitoring within PHP, … but no luck yet.

Now I wanted to ask if there is some possibility to monitor/log if MySQL delivers such a big Resultset - and if - which Query triggered it …

Hope someone here can help me with this?!

Thank you, bye from sunny Austria  
Andreas Schnederle-Wagner

---

<div class="post-metadata">

**Author:** ![Futureweb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/futureweb/32/1034_2.png) [@Futureweb](https://forums.percona.com/u/Futureweb)\
**Post date:** [December 1, 2014, 7:18am UTC](https://forums.percona.com/t/finding-source-of-massive-traffic/3836/2 "2014-12-01T07:18:44Z")

</div>

really noone?! :-/

---

<div class="post-metadata">

**Author:** ![courtos](https://avatars.discourse-cdn.com/v4/letter/c/e19adc/32.png) [@courtos](https://forums.percona.com/u/courtos)\
**Post date:** [December 4, 2014, 11:09am UTC](https://forums.percona.com/t/finding-source-of-massive-traffic/3836/3 "2014-12-04T11:09:22Z")

</div>

According to me, if peak time is predictable ; it could be easy to tcpdump on port 3306 during the peak and after analyze data pt-query-digest.  
you can find an example here : [url][http://www.percona.com/doc/percona-toolkit/2.2/pt-query-digest.html[/url]](http://www.percona.com/doc/percona-toolkit/2.2/pt-query-digest.html%5B/url%5D)

---

<div class="post-metadata">

**Author:** ![Futureweb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/futureweb/32/1034_2.png) [@Futureweb](https://forums.percona.com/u/Futureweb)\
**Post date:** [December 5, 2014, 4:32am UTC](https://forums.percona.com/t/finding-source-of-massive-traffic/3836/4 "2014-12-05T04:32:23Z")

</div>

unfortunately those Times are completely random … sometimes 1-2 weeks no spike - then 3-4 Spikes within one day …  
As there is generally lot’s of Traffic to/from this MySQL Server - TCPDUMP would be pretty big … 😉