How to calculate which virtual machine is being attacked?

Question

SSH

Hai.
There is a small hosting, we issue KVMs "for our own". Kvma for nat.
An abuse has arrived that from our IP they are spamming on port 22 to another service.
How to calculate the virtual machine from which the attack is taking place?
Thank you.

Answer 1

I guess you can sniff the traffic.
This helped me www.binarytides.com/linux-commands-monitor-network