1

I have a problem with my VPS hosted by OVH in France: I have a high traffic. If I look at ifconfig it gives:

eth0      Link encap:Ethernet  HWaddr XXXX
           ... ... ...
          RX bytes:6561541076 (6.5 GB)  TX bytes:370590231 (370.5 MB)

so a bigger traffic in RX than in TX.

Next if I have a look at nethogs:

  PID USER     PROGRAM                                    DEV        SENT      RECEIVED
10141 alexis   sshd: alexis@pts/1                         eth0     375.118   263.438 KB
?     root     5.196.13.44:20000-5.196.13.22:59169                  0.000     50.912 KB
?     root     5.196.13.44:13003-5.196.13.22:38136                  0.000     18.305 KB
?     root     5.196.13.44:13016-5.196.13.22:38112                  0.000      0.605 KB
?     root     188.217.151.184:62559-92.222.217.15:12000            0.000      0.527 KB
?     root     66.249.78.243:36551-37.187.181.55:80                 0.000      0.434 KB
?     root     37.187.195.216:52927-37.187.55.179:80                0.000      0.434 KB
?     root     79.2.118.27:4475-37.187.53.170:34555                 0.000      0.410 KB
?     root     80.43.165.147:30378-92.222.217.231:12689             0.000      0.410 KB
?     root     94.3.174.108:23526-92.222.217.231:12689              0.000      0.410 KB
?     root     2.127.10.45:20002-92.222.217.231:12689               0.000      0.410 KB

So with hundreds of lines that I don't have a clue what they are and show clearly a higher RX traffic than TX. It is weird because no device is specified and no pid neither

I had a look at netstat but everything looks normal. I tried to IPTABLES-DROP everything except the SSH but problem remains

Any clue about how I can fix that problem. By the way the traffic is sometimes slow and the ping is unstable

Improve this question
4
  • 1
    What is your reasoning to think that this traffic is malicious? What is your reasoning that RX being higher is a bad thing? Other than that, you give us very little information to work with.
    – Peter
    Dec 3, 2014 at 10:57
  • The problem is that my connection is unstable (ssh deconnections + ustable ping). So I look at nethogs and I found all these weird lines. So I wonder if I am under attack. What kind of information is missing?
    – alexislg
    Dec 3, 2014 at 12:44
  • What are you hosting on this server? Where are you in relation to the server (as that contributes to ping/ssh lag times)?
    – Nathan C
    Dec 3, 2014 at 12:59
  • This server is used for Apache2 web hosting + OpenVPN server. But there are not involved since the issue remains even after I kill them. I am connected through ssh at ~ 500 km from it. the unstable ping is when I ping other VPS or addresses like google.com. In the past there used to be no problem.
    – alexislg
    Dec 3, 2014 at 13:16

1 Answer 1

Reset to default
2

Problem solved.

The problem was coming from one of the switches used by my hoster. My VPS was receiving many packets not intended for it. That is why I had this weird traffic with nethogs.

They fixed the problem

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .