We are in the process of migrating this forum. A new space will be available soon. We are sorry for the inconvenience.

MRTG shows constant incoming traffing


Stanton
2016-05-15, 08:20 PM
Quote Originally Posted by jsalatas
I just opened a ticket. Hope they reply soon
Honestly, from my personal experience I tend to see a lot of erroneous traffic, 99% probably because of the layer 2 overlay instead of layer 3 boundaries, but IPv4 is sparse, so I wouldn't complain about it. That I still have to use HE tunnels for IPv6 since I can't really sub-divide a /64 instead of them routing a /56 or something is probably my biggest grief. I use an NFV framework to firewall most of my servers, so it's usually just bs traffic that I null route and doesn't really effect performance. If it did, I would probably look to renting a firewall which they do offer.

jsalatas
2016-05-06, 04:08 PM
I just opened a ticket. Hope they reply soon

jsalatas
2016-05-06, 03:25 AM
No, I haven't installed any firewall.

I didn't show it to OVH yet, as I wanted to make sure it isn't normal. Will ask OVH support soon.....

24x7servermanagement
2016-05-06, 02:58 AM
Did you showed this to OVH ? And have you installed firewall like CSF ?

jsalatas
2016-05-05, 05:26 PM
Hi,

I own a dedicated server at soyoustart (Canada) and since yesterday (May 4th) at about 5:00AM I noticed a constant incoming traffic of about 100KBps as you can see in the screen shot below (the start is indicated with the red arrow) .

https://ictpro.gr/screenshots/mrtg.png

trying to troubleshoot it, I terminated every network listening service (except ssh) and executed the ifstat command
Code:
root@nsxxxxxxxxx:~# ifstat 
       eth0       
 KB/s in  KB/s out
   39.21      0.15
    8.81      1.22
    0.13      0.13
   15.37      1.14
   60.08      0.20
   95.59      0.67
  113.27      0.20
  133.00      0.72
  120.90      0.26
   91.94      0.81
  123.99      0.29
  107.13      0.66
  104.46      0.13
   88.49      0.43
   72.08      0.13
   45.85      0.49
    9.35      0.23
    0.20      0.55
   16.68      0.13
   62.18      0.60
   95.50      0.20
  121.18      0.61
  123.45      0.20
  124.08      0.43
  104.33      0.26
  117.66      0.61
  104.38      0.26
  111.76      0.82
   92.76      0.13
   71.04      0.49
   36.39      0.13
    5.44      0.55
    0.07      0.13
   17.68      0.60
   61.19      0.29
   94.73      0.63
  115.98      0.13
  133.27      0.61
  106.25      0.26
  119.83      0.47
  101.46      0.42
  111.10      0.66
  113.59      0.13
   99.53      0.64
   66.45      0.13
   36.06      0.58
    8.29      0.13
    0.14      0.44
   18.15      0.43
   62.19      0.53
   97.12      1.32
  116.27      1.35
  119.87      0.29
  132.01      0.93
   95.56      0.20
  110.17      0.61
  107.78      0.26
  108.75      0.66
  102.22      0.46
   76.78      1.00
   37.63      0.13
    1.99      1.07
    0.27      0.13
   18.63      0.73
   61.87      0.23
   94.98      0.82
  114.51      0.32
  117.15      0.72
  120.38      0.20
  123.58      1.02
   98.63      0.26
  114.35      0.47
  110.36      0.13
   90.63      0.43
   67.21      0.13
   31.62      0.64
    5.24      0.13
    0.20      0.55
   19.09      0.20
   63.27      0.55
   92.60      0.13
  126.53      0.86
  119.55      0.36
  120.40      0.72
  107.54      0.20
  101.84      0.44
  113.66      0.26
  112.87      0.57
   91.81      0.29
   70.62      0.57
   37.24      0.20
    7.76      0.78
    0.13      0.13
   21.26      0.86
   66.58      0.32
   99.84      0.64
  118.35      0.26
  123.53      0.63
  121.76      0.20
  115.32      0.64
   99.83      0.13
  116.83      0.82
  106.82      0.20
   91.13      0.70
   61.54      0.13
   33.66      0.87
    5.64      0.23
    0.14      0.52
   21.40      0.36
   65.25      0.67
   96.39      1.28
  120.39      1.57
  124.54      0.23
  111.46      1.00
  100.03      0.26
  113.43      0.58
  110.85      0.20
  107.00      0.60
   85.52      0.36
   61.22      0.55
   29.09      0.13
    1.92      0.97
    0.20      0.13
   22.46      0.92
   66.19      0.26
   95.34      0.71
  111.49      0.20
  130.02      0.75
  115.58      0.26
  106.20      1.25
  102.73      0.29
  109.64      0.61
  106.67      0.13
   99.27      0.57
   74.43      0.13
   28.88      0.47
    0.69      0.70
    0.39      0.25
   22.80      0.13
as you can see, it seems that something is triggering incoming traffic every 15secs. In order to investigate further, I run the iftop command and noticed that most of the traffic where originated from ovh servers

167.114.37.1 netmon-1-bhs.ovh.ca
198.27.65.66 euro-shared.olnevhost.net
213.186.33.99 cdns.ovh.net
92.222.184.1 netmon-1-rbx.ovh.net
92.222.185.1 netmon-1-sbg.ovh.net
92.222.186.1 netmon-1-gra.ovh.net

and also from a multicast or something address
224.0.0.2 all-routers.mcast.net


Is this kind of constant traffic normal? If so, why it started yesterday and wasn't there before?

Thank you in advance!