What can I use to monitor and log incoming/outgoing traffic to/from remote hosts?

ntop is probably your best solution for doing this. It is designed to run long term and capture exactly what youre looking for.
It can show you what remote destinations are being used the most, how much traffic sent to/from, what protocols and ports were being used etc. It can do the same for the source hosts if you run it on a router so you can see the same stats on local clients as well.
It then uses a web GUI to navigate and display this information.

ntop


If you have root, you could just use tcpdump and grab everything. You can then pull it up in Wireshark and analyze to your heart's content.

$ sudo tcpdump -i <interface> -w mycapture.tcpdump  

... and then hit ctrl-c when you've had enough. Run in a screen session if you need to detatch, etc.

By default, it'll only capture the first part of each packet, but since you're mostly interested in origin analysis that should be fine. Tons of other options to tcpdump if you're feeling adventurous.

EDIT: In fact, once loaded into Wireshark, you can just use the menu option Statistics | IP Addresses... and get a nice summary of traffic by count/rate/percent:

enter image description here


And for a more advanced metrics you can use something like monitorix which have modules for most common services and it's just a simple:

apt-get install monitorix

Also you have cacti an complete GUI RDDtool, but not real time.

And in the top 1 for me it's the multi-configurable grafana. Its a little bit more difficult to install & configure but it's just perfect, you can measure everything in detail and real-real-time. It needs some dependencies JVM,graphite, whisper,... some knowledge about JSON, but works like a charm I really recommend it!

Maybe a good config for your case should be:

collectd + graphite + whisper + grafana

Actually grafana changed my life in the office.