Idle Ubuntu Server with only standard system services running produce 2-6 GB incoming traffic per day
1
vote
0
answers
69
views
I recently setup a new server with Ubuntu 22.04. No web server, no no FTP server, no mail server; just a freshly installed Ubuntu Server where I did not much except installing some extras like
nethogs
and btop
.
Since about two weeks ago I've noticed that for some reason every day there is incoming traffic of 2-6 GB.
I don't know what produces that much traffic, as the only thing which could create some incoming traffic should be unattended updates, but that many updates per day sounds strange to me.
So I installed nethogs
and I can see very strange connections to random IPs.
There are no connection attempts (at least no successful ones), I installed fail2ban
, I disabled ssh root login, I changed ssh port).
nethog
shows this:
PID USER PROGRAM DEV SENT RECEIVED
33870 myuser sshd: myuser@pts/2 eno1 0.148 0.059 KB/sec
? root SERVERIP:2096-65.49.20.118:50513 0.011 0.012 KB/sec
? root SERVERIP:82-185.224.128.43:57350 0.000 0.000 KB/sec
? root SERVERIP:51580-162.216.149.14:57199 0.000 0.000 KB/sec
? root SERVERIP:33126-162.142.125.134:15363 0.000 0.000 KB/sec
? root unknown TCP 0.000 0.000 KB/sec
Examining the IP addresses shows this:
for ip in 65.49.20.118 185.224.128.43 162.216.149.14 162.142.125.134; do printf '%s\t%s\n' "$ip" "$(dig +short -x "$ip" | xargs)"; done
65.49.20.118 118.64-26.20.49.65.in-addr.arpa. scan-17m.shadowserver.org.
185.224.128.43
162.216.149.14 14.149.216.162.bc.googleusercontent.com.
162.142.125.134 scanner-01.ch1.censys-scanner.com.
Asked by Luke
(21 rep)
Jun 6, 2024, 09:48 AM
Last activity: Jun 7, 2024, 07:19 AM
Last activity: Jun 7, 2024, 07:19 AM