Strange server behaviour
 

I started to get complaints from members this week about slow download speeds from my server at i3d in Rotterdam. Yesterday I checked the graphs and the server is generating a constant 10 to 20mbit/sec bandwidth, not leaving enough room for other traffic even though it should have an unmetered 100mbit/sec connection. I can't even wget files to another server anymore, lucky if I'm getting 10kbit/sec, most of the time it stalls.

First I thought the server was hacked or used for a DDOS, so this morning I remotely switched it off completely, but now the strange thing is that even when it was switched off for a few hours, the graphs still show 10mbit/sec bandwidth during that period. How is this possible? Something wrong with the connection?

http://www.femanic.com/server.gif

Thats a huge jump in out traffic. Checks what's running and consuming the resources.

My guess is you did get hacked.

Yeah, looks like it - although it still doesn't really explain why 10 to 20mbit outgoing already maxes out his 100mbit unmetered line and why the traffic doesn't stop when turning off the server.

The graph is from the switch connected to your server.

your switch is overloaded, not your server. Look at the server cpu usage.

That's the strange thing, cpu nor server memory is overloaded and I don't see anything of this bandwidth in the server stats itself either. But yes if this bandwidth persists when server is switched off, it can't be generated by the server, right? And this connection sure isn't 100mbit either, right? I feel like I'm getting fucked up my arse again, why does this always happen to me, a good person?

glad you figured it out.

Outbound is traffic TO your server (the graph shows the connection from the perspective of the switch), so you can still have that traffic with the server switched off. My suspicion would be when your server is on look at the CPU load, and check the http logs. If you don't see unusual activity your host is probably being hosed and the target is another server that's also on your switch. You're seeing chatter across the switch. It's like noise that filters across the connections. Contact your host for an update.

you sure you haven't been attacked ? you should probably have someone jump in there and check it out . If you need any help or advice feel free to icq me

Because good people generally look more aesthetic than bad people making them the target of ones affection at a higher rate.

I think it looks like an attack as well. The sudden spike makes it apparent something is going on.

If you are paying for dedicated 100mbit then you should be periodically testing your server to make sure you can actually use about 80% of that. I've heard of some providers playing games.

Update: they connected the server to another switch, assigned other ip addresses to it and now it works fine again apart from the promised 100mbit/sec speed, they said they can get 1.5mbit/sec at the most. Needless to say that I won't be their long term customer. Am moving everything to another server elsewhere already. I may even demand a refund for the in advance paid fee.

if you need a speed test from another dc to test your real bandwidth, hit me up. you have my email already.

Update: the problem was solved the same day already after I put some gentle pressure on them. They connected to server to another switch/ip address and it's much faster now. I don't think it's 100mbit/s yet, I'm now getting 20mbit/s from server to server. Borked: a test would still be interesting so I'll mail you about that this week.

lol get a real host.

Install a piece of software you can run in ssh called 'iptraf'. It's a nice graphical interface for seeing how much BW is being used by each port going in and out.

ftw :thumbsup

Ok thanks for the suggestion I'll ask someone to install that on the server. And I cancelled the server contract, of course. This was the last in a long row of incidents,they are inbreed imbeciles and I already have another server at a great hosting provider elsewhere.

the stats are week old.
check the dates on them

go to ssh and run
service mrtg restart

hit me up if you need any help
http://www.awmzone.com/services

The stats are within 24 hours from when the initial post was made ><