Recently one of my servers has been subjected to malicious ddos attacks.

I have about 12 websites hosted on the server which uses name based v-hosting.

I am trying to identify which virtual host(s) are getting bombarded with traffic.

I have used tools such as iftop which is good for identifying hosts which are consuming lots of bandwidth, and also apachetop which is useful for identifying which resources are being requested on a single v-host.

What I really need is a tool which allows me to see the amount of traffic being received by each v-host in real time so I can easily see which v-host is being targeted.

Does such a tool exist?