I have a dedicated server with a 100 Mbps port. A few times a week, there comes a time (usually in the evening hours) when there is an extremely high bandwidth usage, by far more than usual.
I am on CentOS 6 with cPanel and host a few dozen websites. I have installed IPTraf to be able to monitor the bandwidth usage in real time. During those evening hours, the lo interface shows about 55 - 90 Mb/s and the eth0 interface about 5 to 20 Mb/s. Which, added together, equals about 70 to 100 Mb/s. This lasts for about 3-4 hours and the server is hardly reachable. After that, the activity drops to something between 100 Kb/s and 2 Mb/s and it stays that way for the majority of hours during the day.
I also have csf installed and I have only allowed certain ports to go through, but in IPTraf's traffic monitor I see a lot of IP addresses with random ports like 51970 or 45398 connecting to the server.
What issue could I be facing here?
sar
to monitor io/cpu during the night as welllo
is strange...eth0
is physical,lo
is internal (doesn't use up bandwith), so it isn't network. The "random ports" from which the connections come are normal, BTW.lo
interface shows around 140 Mb/s and even more (andeth0
is about 30 Mb/s). What could that mean?