0

I have a dedicated server with a 100 Mbps port. A few times a week, there comes a time (usually in the evening hours) when there is an extremely high bandwidth usage, by far more than usual.

I am on CentOS 6 with cPanel and host a few dozen websites. I have installed IPTraf to be able to monitor the bandwidth usage in real time. During those evening hours, the lo interface shows about 55 - 90 Mb/s and the eth0 interface about 5 to 20 Mb/s. Which, added together, equals about 70 to 100 Mb/s. This lasts for about 3-4 hours and the server is hardly reachable. After that, the activity drops to something between 100 Kb/s and 2 Mb/s and it stays that way for the majority of hours during the day.

I also have csf installed and I have only allowed certain ports to go through, but in IPTraf's traffic monitor I see a lot of IP addresses with random ports like 51970 or 45398 connecting to the server.

What issue could I be facing here?

5
  • 1
    Do you have some kind of backup scheduled to happen at that point in time?
    – Zoredache
    Feb 26, 2013 at 21:45
  • No, backups are around 4-5 AM. All I know is that there is an increased demand for a few websites in the evening.
    – Anderson
    Feb 26, 2013 at 21:57
  • 1
    Also you might want to use sar to monitor io/cpu during the night as well
    – R. S.
    Feb 26, 2013 at 22:05
  • So much traffic through lo is strange... eth0 is physical, lo is internal (doesn't use up bandwith), so it isn't network. The "random ports" from which the connections come are normal, BTW.
    – vonbrand
    Feb 27, 2013 at 0:40
  • There's currently a peak on the server again and my lo interface shows around 140 Mb/s and even more (and eth0 is about 30 Mb/s). What could that mean?
    – Anderson
    Feb 27, 2013 at 17:27

1 Answer 1

4

For the most part, you can ignore lo traffic. That is your loopback adapter, which is used by various linux subsystems. That adapter exists purely within the linux kernel, and traffic through it does not touch your eth0 interface.

The connections you're seeing from high ports are expected. Those are the ports the client opens to make connections to the services you have running on the server.

The easiest way to determine the nature of the traffic spike is likely to watch your webserver access logs.

Beyond webserver logs, to further diagnose the nature of the traffic, you'll need to perform a packet capture. Install tcpdump and then do something like:

$ sudo tcpdump -w packet.cap

This will start a packet capture, writing capture packets to packet.cap. Kill that process when you think you've captured enough traffic, download packet.cap, install Wireshark on your local system, and use that to open up the packet capture file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .