Sudden unexpected increase in network out
Hi. My server has suddenly shot up in network out graph. I'm not expecting any increase in traffic so this is probably malicious. How do I diagnose the cause of this?
https://drive.google.com/file/d/1tTXJJnarx_gyJbrCBGK9YTCXyQpC98aQ/view?usp=sharing
My server is running Ubuntu 20.04 with apache.
I've rebooted the server, I also have a firewall in place. I tried using tools like iftop and nethogs but I'm not sure what to make of the data they are displaying.
Any help from the pros will be much appreciated.
3 Replies
eruzanski
Linode Staff
I see what you're referring to in the IPv6 graph, and your inclusion of the screenshot is greatly appreciated! It appears that a service may have been initiated, triggering external communication over IPv6. This graphical pattern is commonly associated with the initialization of services such as web servers, game servers, FTP transfers, or private network relay services.
However, if this activity wasn't prompted intentionally, it's advisable to follow our "Recovering from a System Compromise" guide, as the graph could potentially indicate an outbound network attack originating from your system. Linode's infrastructure monitoring is designed to notify you via Support Ticket if any activity reaches a threshold where it breaches the Terms of Service.
Considering the relatively low throughput, my inclination is toward the possibility of a latent internal service starting. Otherwise, worst case, a minor compromise. Rest assured, running through your Linode's internal performance monitors and logs should better demonstrate where the network traffic is originating from. I also recommend changing your passwords and conducting a thorough system malware scan, just in case. I hope that helps!
Doesn't seem like a system compromise, rather a DDos attack. I noticed that the bandwidth consumption of one of my sites shot up drastically. I setup cloudflare on it and enabled bot protection and challenges and then the requests subsided.
I heard this happened to a friend of mine as well using Linode. I think you need better DDos protection.
It happened to me also but now the problem is solved.