Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a VPS running CentOS Linux 5.x, with Kloxo server management software.

I kept everything as close to default as possible. I created NS records with my domain name provider, and successfully pointed those NS records to my VPS. Using kloxo I got my domain working for web (Apache) and email (Qmail).

The first problem I noticed was a constant stream of outgoing data from the server, 3-5 Megabits/second. This turned out to be because of open DNS recursion. I disabled recursion on my server (named.conf file), and the problem was greatly reduced - however, I am still seeing a constant, continuous inflow/outflow of data, at about 100kbit/sec in and 350-400 kilobits/second out.

Much better than I was seeing before, but still not satisfactory. I want to shut down this stream, but I can't track down its cause.

What I have tried:

  • I shut down HTTP through Kloxo, it made no difference. This server does not get any real web traffic anyway so I don't think that's the cause.

I installed several apps:

  • IpTraf - this one does not seem to recognize my virtual NIC, "venet0"

  • nethogs - this one only shows about 0.5 Kilobytes/sec outgoing....it is not "seeing" the much larger outgoing traffic

  • vnstat - when I run the following command: vnstat -i venet0 -l, I see a constant inflow (rx) of about 100 kilobits/second, and a constant outflow of about 350-400 kilobits/second, but I do not know what application/service is causing this

  • Ran tcpdump -w LogFile.txt successfully imported the log into WireShark, but I don't have enough network admin expertise to ascertain the source of my incoming/outgoing traffic problem.

Can anyone point me in the right direction on this one? I am hoping to get help on how to track down what's causing the issue, as well as maybe some ideas of the "most common" things to look for which might be causing this in a typical Kloxo default setup.

share|improve this question

closed as off-topic by TomTom, Ward, faker, Falcon Momot, EEAA Oct 7 '13 at 2:45

This question appears to be off-topic. The users who voted to close gave these specific reasons:

  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – Falcon Momot, EEAA
  • "Questions must be relevant to professional system administration. Server Fault is a site dedicated to professionals; novice questions are off-topic. Please see the Help Center for more information on topicality. The best advice we can give you is to hire a professional to help you out." – TomTom, Ward, faker
If this question can be reworded to fit the rules in the help center, please edit the question.

I would recommend hiring/contracting an sysadmin. Server Fault is a place for professional admins only. Please see the help center center for all the details. –  TomTom Oct 6 '13 at 16:00
I don't know what services a default Kloxo setup implies, but you've only mentioned DNS and HTTP, and only mentioned stopping HTTP. If you stop DNS (bind?) does the traffic stop? Can you use the WireShark log and do something like ask.wireshark.org/questions/82/… or blog.davidvassallo.me/2010/03/22/… ? –  TessellatingHeckler Oct 6 '13 at 22:46
Could that 100kBIT/s be from whatever you are using to access the server? Ssh or web management or whatever? –  Grant Oct 7 '13 at 0:21