Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a CentOS installation which is running fairly smoothly.

Today I ran ifconfig mainly to see what sort of usage has been coming across the ethernet interface, and to also check my link speed.

This is what I ended up seeing for the loopback device:

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:10301085132061223274 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13981054163812689233 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:11783901785008000095 (0.6 EiB)  TX bytes:10333501021200548281 (0.9 EiB)

This just feels completely wrong - almost an EiB of data?

Any assistance in tracking down the source of these statistics would be greatly appreciated.

share|improve this question

3 Answers 3

up vote 2 down vote accepted

Does it continually increment?

Take a peek at the data being transferred via:

  • tcpdump -n -i lo

If your screen starts scrolling furiously, hit Control-C and look at the source/destination ports to get an idea of which application is generating the traffic.

If not, save the numbers you see, check again tomorrow, and see how much the counters have incremented by. Rinse and repeat the tcpdump test.

share|improve this answer
    
Looking at tcpdump I see fairly regular HTTP requests. I'll tell tcpdump to dump packet contents so I can see what's actually going on the wire - probably end up finding something seriously misconfigured. Thanks! :) –  Matthew Iselin Mar 23 '10 at 4:41
    
Yup, upon further investigation I find this to be an internal dummy connection used by Apache. At least, that's what the logs seem to point towards :) –  Matthew Iselin Mar 27 '10 at 13:31

What services are you running on this machine? Is there a database that is listening and being accessed on a local connection. run netstat -lnp and look for services that you are using that may be listening on the local interface.

share|improve this answer
    
Postfix and named are the only things listening on the interface. Postfix also seems to have a lot of UNIX sockets. Even so, an exabyte is an awful lot of data to be coming from postfix. I should mention this is after only 69 days of uptime. –  Matthew Iselin Mar 23 '10 at 2:43

Do a netstat -an or just a netstat -a to see a list of everything that is listening and connected to the system (-a means all, -n means "don't bother to translate ip and port numbers into names"). That should allow you to determine what ports are being connected to on localhost, so you can at least tell what service is the culprit. My guess is that there is some backend database or other app that postfix or another front-end program is utilizing. Probably not an issue.

Good luck,

--jed

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.