Understanding your traffic
Most people look at their traffic graph for the first time while something is going wrong. A baseline you already know is worth more than any tool.
Three tools, three questions
- vnstat — how much, over time
apt install vnstat, thenvnstat -dfor daily totals,vnstat -mfor monthly,vnstat -hfor hourly. It keeps a small database and costs nothing to run. Install it on day one; the value is in the history.- iftop — who, right now
iftop -i eth0 -Pshows live connections sorted by rate, with ports. The tool for “something is using the port and I do not know what”.- nload — how fast, right now
- A simple in/out meter. Good for watching a transfer or confirming a port change.
For a quick look with nothing installed, ip -s link show eth0 gives
cumulative bytes, packets, errors and drops.
Read the graph honestly
- Peaks matter, averages do not. A daily average of 200 Mbit with a nightly peak of 4 Gbit is a 10 Gbit requirement, not a 1 Gbit one.
- Watch the direction. A web server sends far more than it receives. If inbound suddenly matches outbound, something changed.
- Errors and drops should be zero. A rising error count on the interface is a hardware or cabling matter and therefore ours — open a ticket.
- Packets per second can saturate before bits per second. Lots of tiny packets is a different kind of load from a few large ones, and it is what an attack usually looks like.
Spotting an outbound attack early
If your machine is compromised, the first visible sign is usually traffic leaving it that you did not send — a flood, a spam run, a scan. See a compromised server.
Set an alert on sustained outbound traffic above your normal peak. That one rule catches most of these cases within minutes rather than when an abuse report arrives. Pair it with a check for unexpected listening ports:
ss -ltnp
Anything on that list you did not put there deserves immediate attention.
Per-process accounting
nethogs breaks traffic down by process, which answers the question the
other tools cannot: not which connection, but which program. Invaluable on a machine
running many services.
What we see from our side
We graph every port, so if you want to compare your figures with ours, ask. It is also how we notice an attack towards you before you do — see DDoS filtering.
On an unmetered port there is no counter to worry about and no bill attached to a busy month. The reason to watch the graph is operational, not financial: it tells you when your application changed behaviour, and it is the fastest early warning you have.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base