On a server a few KVM/libvirt virtual machines are running. Sometimes these use lots of GB in network bandwidth. I would like to do statistics on network transfers (bandwidth usage, ideally by IP address) in order to rule out foul play (e.g. data exfiltration or flood/DoS attacks).
Is there a way to collect bandwidth data on the KVM/libvirt hypervisor/host side?
The network is currently bridged (without NAT), each VM has its own IP address.
