Home / server / Questions / 361329
Accepted
Phrogz
Asked: 2012-02-18 13:07:38 +0800 CST

Is it normal for inbound traffic to far exceed outbound traffic?

  • 772

I have a web server on a coloc host. All 'planned' activity is over HTTP. (There's no FTP server, no bittorrent client, no IRC bots, etc.)

My inbound traffic is consistently 5-10 times higher than my outbound traffic. (For example, over the past 24 hours I have served 228MB of data, but received 1.94GB.)

  1. Is this standard/expected for a web server? (Am I perhaps getting slammed with thwarted nefarious attempts whose packet size versus a 0-byte response overwhelms the normal inverse relationship?)

  2. If this is not expected, what tools should I use to investigate where the traffic is coming from? (The server is running Ubuntu 10.04.)

enter image description here

ubuntu web-server web-hosting colocation

2 Answers

  1. Best Answer

    Yes for some protocols. No for others. The answer is it depends on what kind of traffic is "normal" for your environment.

    Think about web browsing (and let's just agree for a moment that it's representative of normal internet traffic for say an office):

    I want to look at this question, so I connect to serverfault.com and go

    GET questions/361329 HTTP/1.1
host: serverfault.com

    Total size of my outbound traffic (request): Maybe 1K if we include all the protocol overhead and additional requests my browser will make for images and such.

    The serverfault.com server chews on my request and returns several hundred KB of HTML, images, etc.

    Outbound traffic: 1k. Inbound traffic: 19k (as of that colon).

    If you're the server half of that equation it's normal for your outbound traffic to far exceed your inbound traffic. Take a look at this graph from an anonymous ISP's web hosting network: Shared Hosting traffic

    Now if your traffic does not look the way you think you should a good traffic monitoring system (or a few minutes with tcpdump/ethereal/etc.) may give you an idea of what's going on, or at least who is talking to who on what ports.

    • 6

  2. Random thoughts:

    I have an nginx server that proxies to application servers behind it. If you have a similar setup is the response payload from the app servers that go through your webserver considered "inbound"?

    Can you check your webserver log to see if there are any POST requests coming in.

    Do any URLs on your site accept POST data? Webservers have a way to limit the body size; maybe that'll lead to some resolution. For example, this will limit POST body size to 1 meg in nginx:

    client_max_body_size 1m;

    Finally, if the server shouldn't be getting anything but web (and SSH) traffic, use iptables to block everything but 80 and 22.

    • 1