OVH Community, your new community space.

Crazy traffic in traffic graphs, but nothing in vnstat


jonlewi5
10-05-2010, 23:44
oh and for the record, its over now


jonlewi5
10-05-2010, 23:12
OI OI and has she got a sister

rickyday
10-05-2010, 23:11
Quote Originally Posted by jonlewi5
recently ruby on rails
Who's she?

jonlewi5
10-05-2010, 22:49
thats the thing, iv had this server for about 6 months, it was always used as a play-about-server(tm)
mainly used for learning things, like proxmox, and recently ruby on rails, its mostly run ubuntu desktop as i like a gui when learning new things

Well iv just configured iptables to drop everything apart from ssh although if im honest, i dont understand how this well help stop it

Winit
10-05-2010, 22:36
Clearly you've pissed someone off unless you just happened to recently acquire a bad IP.

jonlewi5
10-05-2010, 16:49
Thanks very much marks, ill get onto it as soon as i get in.

There must be some weird people about on the internet to want to DDoS a server doing nothing haha

Cheers

--did you delete your post marks, now i look a nuttr talking to myself --

jonlewi5
10-05-2010, 16:40
cheers marks, yeah i cant understand it, that server has been sat idle for a while, doesnt host anything, i use it for fiddling with stuff thats it, weird.

I cant do anything with it until im home from work unfortuanatly

marks
10-05-2010, 16:33
you've got a huge amount of constant incoming traffic for the last hours, which it is probably an attack. Now that you've got the server in rescue mode, set up a firewall with, at least, dropping the ICMP traffic.

Check the following guide for more information:

http://help.ovh.com/Firewall

Let me know if you need more help.

jonlewi5
10-05-2010, 14:20
yeah the IP is 91.121.82.132.
Iv just put it into rescue mode just incase something fishy is going on, as im off to a meeting now so cant look into it at all.

The only really odd thing is that on friday or saturday night it stopped responding to pings for about 2 minutes then worked fine?

cheers marks

edit...

hmm interestingly, its in rescue mode and there is still 34meg coming in.....weird

marks
10-05-2010, 14:11
could you tell me what's your IP or server name? if you don't want to post here in the forums, send it to the support and we'll post the results of our investigation here

jonlewi5
10-05-2010, 14:04
Heya,

Last night i noticed some rediculous incoming traffic on my kimsufi box, as there is nothing on there i reformated it thinking it had been compromised.
Well today, i see it happening again.



But when i check vnstat, theres nothing going on on there?

Anyone have any suggestions as to whats going on?