0

I have an Amazon EC2 instance which will periodically receive a spike in network input - always at around 6:45am. It sounds like exactly the same issue in this thread (Analyzing a periodic network spike), but I'm unable to comment on the thread to ask if / how it was resolved. It was suggested to use MRTG to monitor the traffic, but by the looks of it this will only give me the information that the AWS management console gives. I'm guessing the spike will be coming from a single (or limited set of) IP address(s), so I figure the best thing is to find out which IP address the requests are originating from then configure the firewall to block them, but I'm not sure how to go about finding this out.

Has anyone else dealt with this problem before? (The spike on EC2 instances) - it seems very coincidental that the description sounds exactly the same as the other posts - maybe it's an issue with EC2 servers? Or could anyone help with how I would go about finding the IP address of the requests causing the spike so it can be blocked?

Improve this question
2
  • 1
    Are you sure it's not a cron job on your system? For example, just checked a random box and it's cron.daily runs at 06:25. Look at /etc/crontab and possibly /etc/cron.daily/*.
    – chrskly
    Jun 14, 2013 at 15:17
  • By the looks of it it might be a cron job. I'll have to look into which ones run daily (not done much with cron before). Thanks for your help.
    – Andrew Porritt
    Jun 18, 2013 at 13:00

2 Answers 2

Reset to default
0

I had the same issue with the same time. It ended up being /etc/cron.daily/apt

Improve this answer
0

You can deal with it in many ways, but i would suggest at least 2:

  • Look at the Cloud Watch events and metrics to discover more information related to you network traffic. You can enable VPC Flow logs, and take a look into as well. Generally it´s hard to do this kind of deep investigation, need high network knowledge.
  • Use a specialized solution of NGFW(Next Generation Firewall) it will give you a totally visibility of your traffic at application level, and give you options to monitor, block or allow this kind of traffic. It´s not possible to do with regular AWS services like: Security Group, NACL or AWS Firewall(they are very limited) For the second option, i suggest FortiGate that you can find in AWS MarketPlace.

Some references: https://www.youtube.com/watch?v=nr-ZzYvh-zs https://docs.fortinet.com/document/fortigate-public-cloud/7.2.0/aws-administration-guide/619591/single-fortigate-vm-deployment

Have Network Traffic visibility in the Cloud is mandatory to keep control and security.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .