Why has my server's data usage increased?

Server Config
1

I use a tool called vnstat to track my server’s data usage. It has recently increased by a good deal (5x), starting on the 24th of November.

         day         rx      |     tx      |    total    |   avg. rate
     ------------------------+-------------+-------------+---------------
     11/03/2020    73.07 MiB |   67.36 MiB |  140.43 MiB |   13.63 kbit/s
     11/04/2020   155.35 MiB |  646.26 MiB |  801.61 MiB |   77.83 kbit/s
     11/05/2020   144.24 MiB |  241.93 MiB |  386.17 MiB |   37.49 kbit/s
     11/06/2020    85.88 MiB |  211.32 MiB |  297.19 MiB |   28.85 kbit/s
     11/07/2020   154.78 MiB |  220.32 MiB |  375.10 MiB |   36.42 kbit/s
     11/08/2020   136.03 MiB |  188.38 MiB |  324.42 MiB |   31.50 kbit/s
     11/09/2020   134.28 MiB |  191.45 MiB |  325.73 MiB |   31.62 kbit/s
     11/10/2020   100.16 MiB |  127.50 MiB |  227.66 MiB |   22.10 kbit/s
     11/11/2020    80.47 MiB |  110.81 MiB |  191.28 MiB |   18.57 kbit/s
     11/12/2020   131.45 MiB |  131.99 MiB |  263.44 MiB |   25.58 kbit/s
     11/13/2020    98.17 MiB |   69.95 MiB |  168.12 MiB |   16.32 kbit/s
     11/14/2020   142.60 MiB |  135.49 MiB |  278.09 MiB |   27.00 kbit/s
     11/15/2020   194.34 MiB |  191.05 MiB |  385.40 MiB |   37.42 kbit/s
     11/16/2020   193.48 MiB |  172.80 MiB |  366.28 MiB |   35.56 kbit/s
     11/17/2020   173.39 MiB |  178.82 MiB |  352.21 MiB |   34.20 kbit/s
     11/18/2020   148.52 MiB |  261.44 MiB |  409.97 MiB |   39.80 kbit/s
     11/19/2020   112.39 MiB |  147.52 MiB |  259.91 MiB |   25.24 kbit/s
     11/20/2020   117.62 MiB |   92.82 MiB |  210.44 MiB |   20.43 kbit/s
     11/21/2020   106.61 MiB |  128.60 MiB |  235.21 MiB |   22.84 kbit/s
     11/22/2020   449.33 MiB |  502.93 MiB |  952.26 MiB |   92.46 kbit/s
     11/23/2020   288.62 MiB |  345.83 MiB |  634.45 MiB |   61.60 kbit/s
     11/24/2020     1.22 GiB |  277.34 MiB |    1.49 GiB |  148.34 kbit/s
     11/25/2020     3.88 GiB |  401.14 MiB |    4.28 GiB |  425.09 kbit/s
     11/26/2020     3.86 GiB |  392.46 MiB |    4.24 GiB |  421.76 kbit/s
     11/27/2020     3.96 GiB |  457.45 MiB |    4.40 GiB |  437.87 kbit/s
     11/28/2020     4.03 GiB |  431.59 MiB |    4.45 GiB |  442.74 kbit/s
     11/29/2020     4.01 GiB |  411.35 MiB |    4.41 GiB |  438.34 kbit/s
     11/30/2020     3.97 GiB |  465.59 MiB |    4.42 GiB |  439.57 kbit/s
     12/01/2020     4.06 GiB |  418.60 MiB |    4.47 GiB |  444.48 kbit/s
     12/02/2020     1.70 GiB |  188.87 MiB |    1.88 GiB |  424.96 kbit/s
     ------------------------+-------------+-------------+---------------
     estimated      3.86 GiB |     427 MiB |    4.27 GiB |

What is the cause for this? My traffic has not increased and I can’t think of anything else that would be using more data.

1 Like
2

Hi,

There seems to also be a huge shift in receive-transmit ratio at that date.

Could a malware be in action sharing or downloading external data?

Have you checked the host-space your site is occupying?

3

Thats what I was almost wondering. It there an option in vnstat or another CLI util that breaks down data usage by service?

I don’t have full confidence that it is malware as I have checked my server’s IP on blacklists and have seen no results, but its always a possibility.

1 Like
4

I used a tool to determine the IP addresses my machine is talking too:

image
image1920×632 23.6 KB

I’m not too worried as most of this seems to just be grey noise from the internet.

I looked up a few of the IPs here and they just look to be SSH bruteforce attempts.

5

This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.