Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

I have a CentOS 6.4 64Bit Dedicated server used for hosting several websites. I recently checked the traffic graph for my server and discovered that the inbound traffic is very high (about 200-500 Mbit). I don't download anything and I have absolutely no idea why is the traffic so high. the inbound traffic is 200GB already but the HDD doesn't fill up with information. I checked for HTTP DDos but everything seems regular.

Some info:

RAM Usage: 20%
CPU Load: 50%

Services in the server:

  • Apache (local usage only)
  • Nginx (as proxy server)
  • mySQL
  • exim
  • ftp(pure-ftpd)
  • SSH

Allowed ports in csf:

TCP_IN: 20,22,80,2083,2087,21
TCP_OUT: 20,21,22,25,37,43,80,110,113,443,587,873,2086,2087,2089,2703

UDP_IN: 20,21
UDP_OUT: 20,21,113,123,873,6277,53

ICMP_IN is disabled.

Traffic graph: http://i.stack.imgur.com/txoeR.png

I would appreciate any help.
Thanks.

EDIT

I was attacked by DNS DDos Amplification


I was attacked by DNS DDos Amplification

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:39

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
check out the application NTOP –  SpacemanSpiff Apr 1 '13 at 20:21
    
Nginx (as proxy server) <-- there's your problem –  CSᵠ Apr 1 '13 at 22:24

2 Answers 2

Here are some things to try:

  1. Use top to see what processes are using the CPU
  2. ls -lat /var/log to see which services are being used and look at the most active files
  3. Use tcpdump to see the source addresses of the packets that are coming in

Add the results of your investigations to your question and we will probably be able to make more helpful suggestions.

share|improve this answer

This might be some idiot(s) hammering away at SSH or something equally intelligent. If your log files show thousands of connection attempts, use something like fail2ban to spoil them their day.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.