Web Hosting Talk : Web Hosting Main Forums : Dedicated Server : Unbelievable high incoming traffic

[mlx]

I recently noticed unbelievable high incoming traffic on my RaQ and I don't have a clue where it's coming from. Just have a look at the attached image, that's about 2 MBit incoming over several hours (until I manually rebooted the server which stopped it).

I'm quite sure that the traffic was not sent through FTP and HTTP (there is nothing about it in the FTP logs and nothing in the Apache logs).
So does anyone has a clue what's (or what could be) going on there?
Or how to find out? Are there any other logs I should check?

I'm a bit scared since I guess the traffic would still be there if I didn't stop it by rebooting the server manually. So any ideas are highly appreciated.

[dektong]

You might have been DOS attacked, for around 9 hours ... I feel really bad for you. I hope you will be billed based on average, not 95th percentile ... How does this affect you monthly graph?

cheers,

[mlx]

Well I'm with 4webspace and there are still about 60 gb traffic left of the initial 100 gb.
So this should be hopefully no problem.

[ColoCenter]

I'm also have a RAQ with 4webspace and i also checked my traffic. It isn't that high but there is also a rise.
A bit strange since they also had more trouble with code red then other companies?!

In a reply i can't add an attachment so here is the link to my graph
http://www.lanthost.com/fetch.gif

[ColoCenter]

It's starting again
http://www.lanthost.com/fetch2.gif

[Omair Haroon]

Where do you get that image from? I am also with 4webspace.


-Omair

[mlx]

You log in at http://www.tera-byte.com/config and click on "IP Administrator"

[nexzt]

If i recall correctly the blue is outgoing and green is incoming, got a software download of somesort on that server? Also its in bits so its less than you think, watch the graph change to bytes and watch it shrink

[ColoCenter]

yes i know that, but the sudden rise is the strange thing.
There are very few sites on this server, that's why the traffic is so low.

[ColoCenter]

Originally posted by mlx
You log in at http://www.tera-byte.com/config and click on "IP Administrator"

If you can't see the graph, contact support, they'll fix it for you.
It wasn't enabled for me too

[mlx]

@ nexzt:

I know when you install MRTG on your server it's normally the other way round (green=in, blue=out).
But the tera-byte graph (about which we are talking) definitely uses green for outgoing traffic to the internet and blue for incoming.

[ColoCenter]

Then it's very strange the incoming graph is higher then the outgoing!?!

[jahsh]

you might check you /var/log/httpd/access file and look for either default.ida which is code red
cmd.exe which is nimba
they wont harm your system but they will cause traffic and bog your system down

[Omair Haroon]

MLX,

I also recommend you immediately check out your server for NIMDA and Red Code.

That is what I think is causing the increase in Incoming.
But that is just a thought.

For newbies reading this, you just SU to root and type this:

locate default.ida

Thats for Red Code and for Nimda type this:

locate cmd.exe

If any of the two files are there in the server, then you are effected.


-Omair

[webbcite]

Linux servers are NOT affected by Nimbda. RAQ's are Linux, so there is no worries about Nimbda.