1

I have a CentOS installation which is running fairly smoothly.

Today I ran ifconfig mainly to see what sort of usage has been coming across the ethernet interface, and to also check my link speed.

This is what I ended up seeing for the loopback device:

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:10301085132061223274 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13981054163812689233 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:11783901785008000095 (0.6 EiB)  TX bytes:10333501021200548281 (0.9 EiB)

This just feels completely wrong - almost an EiB of data?

Any assistance in tracking down the source of these statistics would be greatly appreciated.

3 Answers 3

2

Does it continually increment?

Take a peek at the data being transferred via:

  • tcpdump -n -i lo

If your screen starts scrolling furiously, hit Control-C and look at the source/destination ports to get an idea of which application is generating the traffic.

If not, save the numbers you see, check again tomorrow, and see how much the counters have incremented by. Rinse and repeat the tcpdump test.

2
  • Looking at tcpdump I see fairly regular HTTP requests. I'll tell tcpdump to dump packet contents so I can see what's actually going on the wire - probably end up finding something seriously misconfigured. Thanks! :) Mar 23, 2010 at 4:41
  • Yup, upon further investigation I find this to be an internal dummy connection used by Apache. At least, that's what the logs seem to point towards :) Mar 27, 2010 at 13:31
1

What services are you running on this machine? Is there a database that is listening and being accessed on a local connection. run netstat -lnp and look for services that you are using that may be listening on the local interface.

1
  • Postfix and named are the only things listening on the interface. Postfix also seems to have a lot of UNIX sockets. Even so, an exabyte is an awful lot of data to be coming from postfix. I should mention this is after only 69 days of uptime. Mar 23, 2010 at 2:43
0

Do a netstat -an or just a netstat -a to see a list of everything that is listening and connected to the system (-a means all, -n means "don't bother to translate ip and port numbers into names"). That should allow you to determine what ports are being connected to on localhost, so you can at least tell what service is the culprit. My guess is that there is some backend database or other app that postfix or another front-end program is utilizing. Probably not an issue.

Good luck,

--jed

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .