iftop is your friend, but basically, that only does you some good when you're not doing NAT.A client is sending out a DOS attack. The process doesn't seem obvious from the top command. Using only command line utilities, how do you determine who the culprit is and how do you suspend their vps?
As I understand it, this is a NAT scheme.