I have a CentOS VPS from UKWSD and I'm getting inbound traffic that I cannot understand.

The VPS was setup yesterday and I installed vnstat this morning around 10am, since then the server was basically idle and doing nothing from 12pm but it's showing activity inbound which is way over what it should be and i'd say the outbound is pretty much over to top too.

Here is vnstat (snapshot taken at 10:30pm GMT) Image

Here is the iptables http://pastebin.com/uGxX2Ucw

The reason I'm concerned is..
1) I have no idea why this is happening, and I like to know what's going on :D
2) I've calculated (briefly) that this pointless traffic would use around 15-20GB of bandwidth per month, and when your on a 150GB limit - it's quite an issue.

I'm struggling to understand this and I thought I'd get some advice before asking my ISP (and risk looking completely stupid)

  • 1
    You can run tcpdump on the server and try determining which IP address/addresses are hitting your server. The command would be ' tcpdump -n -i INTERFACE' where INTERFACE would be the name of the Interface such as venet0:0 or eth0 etc. – Swapneel Patnekar Mar 24 '12 at 6:43
  • Hi Swapneel The problem is - I only have SSH access so I just get spammed with packets that are from me using SSH so can't really see anything. Same goes for when I use iptraf – Clarkey Mar 24 '12 at 9:29

When you purchase/rent a server from a provider, chances are the assigned IP address was used on another customer's account.

This is most likely what has happened here, you have acquired the IP/system of a previous customer and have been getting the traffic they used to get.

There is also a chance a small portion of this incoming and outgoing data could be to do with your providers monitoring system (depending on the system they use).

I would get in touch with your provider and see if there is anything they can do to assist you with this matter.

| improve this answer | |
  • I contacted my ISP and they just said their network is not causing the traffic and it's just bots and other internet crawlers. They was a bit vague. I still think an average of 20mb inbound per HOUR on an IDLE server is too much. – Clarkey Mar 24 '12 at 13:40

Could you find out the source ip distribution, say from your ISP? That would help. Sounds someone is attacking the server, or maybe the server ip used to be a high-traffic server and clients (automated) have cached it. Overall I think you should contact your ISP support who are best equipped to help you.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.