3

I have a CentOS VPS from UKWSD and I'm getting inbound traffic that I cannot understand.

The VPS was setup yesterday and I installed vnstat this morning around 10am, since then the server was basically idle and doing nothing from 12pm but it's showing activity inbound which is way over what it should be and i'd say the outbound is pretty much over to top too.

Here is vnstat (snapshot taken at 10:30pm GMT) Image

Here is the iptables http://pastebin.com/uGxX2Ucw

The reason I'm concerned is..
1) I have no idea why this is happening, and I like to know what's going on :D
2) I've calculated (briefly) that this pointless traffic would use around 15-20GB of bandwidth per month, and when your on a 150GB limit - it's quite an issue.

I'm struggling to understand this and I thought I'd get some advice before asking my ISP (and risk looking completely stupid)

3
  • 1
    You can run tcpdump on the server and try determining which IP address/addresses are hitting your server. The command would be ' tcpdump -n -i INTERFACE' where INTERFACE would be the name of the Interface such as venet0:0 or eth0 etc. Mar 24, 2012 at 6:43
  • Hi Swapneel The problem is - I only have SSH access so I just get spammed with packets that are from me using SSH so can't really see anything. Same goes for when I use iptraf
    – Clarkey
    Mar 24, 2012 at 9:29
  • I'm having a similar issue... around a steady 30MB/hr. Running ntopng it only reports about half that and the only smoking gun I seem to have is that it reports that 92% of it is ARP traffic.
    – Michael
    Mar 7, 2023 at 0:24

2 Answers 2

1

When you purchase/rent a server from a provider, chances are the assigned IP address was used on another customer's account.

This is most likely what has happened here, you have acquired the IP/system of a previous customer and have been getting the traffic they used to get.

There is also a chance a small portion of this incoming and outgoing data could be to do with your providers monitoring system (depending on the system they use).

I would get in touch with your provider and see if there is anything they can do to assist you with this matter.

1
  • 1
    I contacted my ISP and they just said their network is not causing the traffic and it's just bots and other internet crawlers. They was a bit vague. I still think an average of 20mb inbound per HOUR on an IDLE server is too much.
    – Clarkey
    Mar 24, 2012 at 13:40
1

Could you find out the source ip distribution, say from your ISP? That would help. Sounds someone is attacking the server, or maybe the server ip used to be a high-traffic server and clients (automated) have cached it. Overall I think you should contact your ISP support who are best equipped to help you.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .