Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a dedicated server with a 100 Mbps port. A few times a week, there comes a time (usually in the evening hours) when there is an extremely high bandwidth usage, by far more than usual.

I am on CentOS 6 with cPanel and host a few dozen websites. I have installed IPTraf to be able to monitor the bandwidth usage in real time. During those evening hours, the lo interface shows about 55 - 90 Mb/s and the eth0 interface about 5 to 20 Mb/s. Which, added together, equals about 70 to 100 Mb/s. This lasts for about 3-4 hours and the server is hardly reachable. After that, the activity drops to something between 100 Kb/s and 2 Mb/s and it stays that way for the majority of hours during the day.

I also have csf installed and I have only allowed certain ports to go through, but in IPTraf's traffic monitor I see a lot of IP addresses with random ports like 51970 or 45398 connecting to the server.

What issue could I be facing here?

share|improve this question
1  
Do you have some kind of backup scheduled to happen at that point in time? –  Zoredache Feb 26 '13 at 21:45
    
No, backups are around 4-5 AM. All I know is that there is an increased demand for a few websites in the evening. –  Anderson Feb 26 '13 at 21:57
1  
Also you might want to use sar to monitor io/cpu during the night as well –  kormoc Feb 26 '13 at 22:05
    
So much traffic through lo is strange... eth0 is physical, lo is internal (doesn't use up bandwith), so it isn't network. The "random ports" from which the connections come are normal, BTW. –  vonbrand Feb 27 '13 at 0:40
    
There's currently a peak on the server again and my lo interface shows around 140 Mb/s and even more (and eth0 is about 30 Mb/s). What could that mean? –  Anderson Feb 27 '13 at 17:27
add comment

1 Answer

up vote 4 down vote accepted

For the most part, you can ignore lo traffic. That is your loopback adapter, which is used by various linux subsystems. That adapter exists purely within the linux kernel, and traffic through it does not touch your eth0 interface.

The connections you're seeing from high ports are expected. Those are the ports the client opens to make connections to the services you have running on the server.

The easiest way to determine the nature of the traffic spike is likely to watch your webserver access logs.

Beyond webserver logs, to further diagnose the nature of the traffic, you'll need to perform a packet capture. Install tcpdump and then do something like:

$ sudo tcpdump -w packet.cap

This will start a packet capture, writing capture packets to packet.cap. Kill that process when you think you've captured enough traffic, download packet.cap, install Wireshark on your local system, and use that to open up the packet capture file.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.