Web Hosting Talk







View Full Version : Web Noise?


MetaData
06-27-2004, 12:15 AM
I had this server for a month, and over the past month it's been steadily getting about 1000 megabytes of inbound traffic per day...

It is firewalled off so it does not reply or send anything out, it's not a web, or mail, or DNS server. It does not interract with public, and does not generate traffic. These inbound packets just come in on their own for some reason.

I assume this is something left over from the previous owner of the IP?

Patrick
06-27-2004, 12:25 AM
What are the packets doing exactly, are they just ARP replies or what?

Have you run tcpdump to see what's going on?

Cope
06-27-2004, 12:27 AM
Id suspect its just someone probing for holes. I have a box running right now that really doesnt do much right now. It gets a bit of inbound traffic every now and then.

porcupine
06-27-2004, 01:14 AM
Massive shared vlan spewing out broadcast traffic? That'd have to be fairly large one to generate 1GB/day though....

Cirrostratus
06-27-2004, 01:44 AM
Gotta love them worms :)

blaster, sasser etc etc. They scan non-stop along with noisey Windows boxes and game servers doing alot of broadcast traffic. If you can ask for a Private VLAN and you will only see the worms traffic and no broadcast noise.

tsutton
06-29-2004, 09:53 AM
Monitor the data via IPTRAF (logged on as root via ssh) and see what sort of data you see.