Home / server / Questions / 125197
Accepted
Matthew Iselin
Asked: 2010-03-23 17:46:00 +0800 CST

CentOS - massive usage on loopback interface

  • 772

I have a CentOS installation which is running fairly smoothly.

Today I ran ifconfig mainly to see what sort of usage has been coming across the ethernet interface, and to also check my link speed.

This is what I ended up seeing for the loopback device:

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:10301085132061223274 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13981054163812689233 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:11783901785008000095 (0.6 EiB)  TX bytes:10333501021200548281 (0.9 EiB)

This just feels completely wrong - almost an EiB of data?

Any assistance in tracking down the source of these statistics would be greatly appreciated.

centos bandwidth loopback

3 Answers

  1. Best Answer

    Does it continually increment?

    Take a peek at the data being transferred via:

    • tcpdump -n -i lo

    If your screen starts scrolling furiously, hit Control-C and look at the source/destination ports to get an idea of which application is generating the traffic.

    If not, save the numbers you see, check again tomorrow, and see how much the counters have incremented by. Rinse and repeat the tcpdump test.

    • 2

  2. What services are you running on this machine? Is there a database that is listening and being accessed on a local connection. run netstat -lnp and look for services that you are using that may be listening on the local interface.

    • 1

  3. Do a netstat -an or just a netstat -a to see a list of everything that is listening and connected to the system (-a means all, -n means "don't bother to translate ip and port numbers into names"). That should allow you to determine what ports are being connected to on localhost, so you can at least tell what service is the culprit. My guess is that there is some backend database or other app that postfix or another front-end program is utilizing. Probably not an issue.

    Good luck,

    --jed

    • 0