I have an EC2 CentOs instance on AWS with nginx that has been pumping out major outgoing traffic, which of course is pumping up my monthly cost.
How can I track down what is sending so much data?
You can use various tools to track down network bandwidth usage - the most useful I have found is iftop
from the command line.
This is only a point-in-time snapshot however (much like top
and htop
), but if your instance is constantly generating traffic, this should enable you to see where it is going.
ss
utility to get a list of connections and what application they're related to, for example ss -nap
. Between ss
and iftop
, you should be able to figure it out.
I have used ntop
for years, although it might be overkill for your situation since it includes a web interface to view the data.
You may also be able to utilise the VPC traffic flow logging functionality released today. You should be able to enable that on a specific ENI or a whole subnet.
One method of actually analysing the traffic would be to create CloudWatch metric filters to sum up traffic on particular ports or IPs. Alternatively you could export or stream the logs from CloudWatch to S3 and analyse them using an another tool (eg. EMR).