Possible DDoS (not sure). Cannot trace with netstat

Question

I have a KVM node I'm running with only 7 VM instances. When GigE uplink port is enabled, server connection goes crazy hitting over 300MBps somehow. I cannot trace which IP is possibly being attacked, or vice versa (it appears in Observium to be outgoing spikes not incoming).

My issue is netstat is not providing any info. I want to know specifically where the connections are coming from, whether in or out and which specific IP, or even VM server.

I'm running Centos 6.8 64bit on the KVM node.

[root@server ~]# netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
[root@server ~]# netstat -ntu | grep ESTAB | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr
      3 xxx.xxx.xxx.xxx
      1 8.8.8.8
[root@server ~]# netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1
[root@server ~]# netstat -n -p | grep SYN_REC | sort -u
[root@server ~]# netstat -n -p | grep SYN_REC | awk '{print $5}' | awk -F: '{print $1}'
[root@server ~]# netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
      1 8.8.8.8
      1 Address
      1 servers)
      4 xxx.xxx.xxx.xxx
[root@server ~]# netstat -an | grep :80 | sort
[root@server ~]# netstat -n|grep :80|cut -c 45-|cut -f 1 -d ':'|sort|uniq -c|sort -nr|more
[root@server ~]# netstat -an | grep ESTABLISHED | awk '\''{print $5}'\'' | awk -F: '\''{print $1}'\'' | sort | uniq -c | awk '\''{ printf("%s\t%s\t",$2,$1); for (i = 0; i < $1; i++) {printf("*")}; print ""}'\''
> ^C
[root@server ~]# netstat -an | grep :80 | sort
[root@server ~]# netstat -n -p|grep SYN_REC | wc -l
0
[root@server ~]# netstat -n -p | grep SYN_REC | sort -u
[root@server ~]# netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
      1 xxx.xxx.xxx.xxx
      1 Address
      1 servers)
      4 xxx.xxx.xxx.xxx
[root@server ~]# netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
[root@server ~]# netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1
[root@server ~]# 

Answer 1

While it is interesting that nothing is showing up in netstat, you could attack this problem from a different angle. If something is sending 300 MB/s it will most likely be chewing up a decent amount of CPU ... try running top and based on the services that are using the most CPU check logs accordingly.