debian: count connections/traffic to closed ports

Question

I got a new VPS on the same machine on which I already have a VPS. But up-/download is much slower on the new VPS. Is there a possibility to check if there are clients trying to connect to a closed port and block the bandwith with these requests? For example if the previous owner of the IP address used the IP to control a botnet or whatever and those bots are connecting to my new VPS on some port? (had that on my old VPS on port 80 but they gave me a new IP :) ).

Already checked port 80 but there are no illegal connections coming in.

Answer 1

I'd take a look at route on both VPSs, some kind of networking configuration problem might be to blame.

To look at the network activity on your computer, you can use tcpdump. If there's lots of random traffic that's not useful, it will flood your screen with lines recording packets. It's important to never capture SSH packets if you're connecting over SSH:

tcpdump not port ssh

If it turns out to be a problem with lots of people trying to connect, your best bet is probably to talk to support at your hosting company, they should be able to filter stuff for you. Or you can use fail2ban, which can block IPs based on bad behavior of various kinds.

But really, I think this is a question for your hosting provider... what are you paying them for, anyway? They should be able to tell you what the problem is.

Answer 2

you could set up an iptables rule to allow all traffic on your service ports, then log everything else, so you can see what traffic is getting dropped.