how much Bandwidth Kloxo uses?

Pats

Hi,

If left idle for 15days or 1 month, how much Bandwidth Kloxo installation uses?

And there are no domains configured with Kloxo, just only its installed via Hypervm-HostInABox and left idle. (Nope i'm not confusing with Space usage or RAM usage..)

Thanks

jarland

Almost none. You can't account for variables out of your control though. If you accept (not even intentionally) any type of incoming traffic it's a dice roll.

HalfEatenPie

To my understanding Kloxo uses almost no bandwidth when you just leave it alone for a long time (no domains and whatnot).

I mean it itself is a control panel and I don't think it self-updates (although someone else can totally correct me on this)

Pats

@HalfEatenPie said: I don't think it self-updates

correct..

Pats

@jarland said: Almost none

@HalfEatenPie said: To my understanding Kloxo uses almost no bandwidth when you just leave it alone for a long time (no domains and whatnot).

I also thought so... but why i asked this question? I got a LEB box 2.5months ago, login to its HyperVM and installed Template HostInABox (Kloxo) using quite strong password. Login to SSH and checked all services, memory etc.

I left it like that while concentrated on other things. Now when i intended to use it, i found the VPS down (ssh couldn't connect, couldn't ping). Thought of re-starting it from Hypervm, but couldn't login got error Disabled.

Contacted Support and got reply that VPS is Suspended as it has Exceeded the Bandwidth Limit.

I was stunned to read that - 1 TB /mon. bandwidth - used up ? how??

HalfEatenPie

Hm, did you tell them about that?

That does sound quite fishy

Pats

i've asked for detailed bandwidth graphs first, let me see what they give..

Pats

ok here i got details.. with reason - most-likely due to DoS/DDoS attack that drained bandwidth

so, DoS attack on VPS, whole 1 TB bandwidth used up, and what they have taken action is to suspend.. ? wouldn't they know attack is ON and NULLify it ??

Maounique

I am not sure, but i think hostinabox comes with default admin passowrd for kloxo panel. If someone found the port and tried the password... Also, if you didnt update it, could have had security vulnerabilities. It is possible that your box ATTACKED other hosts, not receive attacks because it is highly unlikely a blank installation will draw some hate, no matter how paranoid are the script kiddies. M

Jeffrey

Almost nothing, the only time it would use bandwidth is when you are installing Kloxo or updating it or from clients.

Pats

i did that post installation configuration of Kloxo.. strong password, lxguard etc. login to ssh, updated kloxo to the latest - all these was done.

@Maounique said: Also, if you didnt update i

khuongcomputer

@Pats said: wouldn't they know attack is ON and NULLify it ??

Yes, if they can monitor ~100 VPS for 24/7 and see every bytes of traffic if they're ddos-signal or not then they can block it when there's an attack. Btw, if you can scout every sand on the beach and see if one has sharp edges and pick it out so the others can't be cut, they will monitor their VPS like that.

gsrdgrdghd

@khuongcomputer said: Btw, if you can scout every sand on the beach and see if one has sharp edges and pick it out so the others can't be cut, they will monitor their VPS like that.

Since when is a DDoS attack a grain of sand to a hoster? If it was, he wouldn't have to care for it. There are plently ways to detect a DDoS attack.

dnom

You got D(D)oS'ed and your vps sent ~1TB BW and only recieved 60 mb? What kind of DoS/DDoS was that?

gsrdgrdghd

No his VPS was used to DoS someone else.

khuongcomputer

@gsrdgrdghd said: Since when is a DDoS attack a grain of sand to a hoster? If it was, he wouldn't have to care for it. There are plently ways to detect a DDoS attack.

Since the time people think it's different from a normal in/out traffic action. My websites are using 5-15TB bandwidth per month, if any providers think of "high traffic websites" ~ "ddos action", I will be notified 10-15 times a month "your VPS using 1TB, that's ddos". LOL.

As long as you don't abuse other users (like causing high i/o, network down, or CPU high usage), your provider don't take action as they couldn't (and shouldn't know) what you do with your VPS (or you'd rather want them to sneak into every corner of your VPS to see what you uploaded and what you will do? I won't.)

In this case, his VPS just used the bandwidth he was allocated, that's a fair usage and his provider didn't take action, until it reached the bw limit and suspended automatically. Or someone didn't understand the term "self-managed"?

dnom

@gsrdgrdghd said: No his VPS was used to DoS someone else.

I see.. @Pats better take action now.

gsrdgrdghd

@khuongcomputer every decent DDoS affects other customers on the same node. In @Pats case its hard to say what kind of DoS it was (since we only saw a monthly statistic). If the TB was used equally over one month (~ 1mbit/s) the provider couldn't have taken any action, but if it was all used within a few hours they would have noticed something being wrong.

khuongcomputer

@gsrdgrdghd said: every decent DDoS affects other customers on the same node. In @Pats case its hard to say what kind of DoS it was (since we only saw a monthly statistic). If the TB was used equally over one month (~ 1mbit/s) the provider couldn't have taken any action, but if it was all used within a few hours they would have noticed something being wrong.

Decent ddos doesn't mean stupid ddos. If I know that his hosting/vps has only 100GB or around 1TB bandwidth, and every of his page cost ~1MB then I will slowly take 2 days to drain it out. Not bump everything in at once to raise his alarm so he can setup a firewall to block the ddos out. That's what I will call a decent ddos, not using 1000 connections per time to black out his VPS for 1 hour, then it will come back with a "decent firewall" to block my "decent ddos".

And once again, I will never accept any provider sending email like "Your VPS is using 1TB last hour, you should take a look". I rented a VPS and even if I use up all of alloted bandwidth in 2 days, that's my job, as long as I don't bother any other customers.

gsrdgrdghd

@khuongcomputer said: And once again, I will never accept any provider sending email like "Your VPS is using 1TB last hour, you should take a look". I rented a VPS and even if I use up all of alloted bandwidth in 2 days, that's my job, as long as I don't bother any other customers.

Then you should probably read the providers TOS and AUP more carefully. They always say that you will be terminated if you abuse your allocated ressources or affect other customers. Your 1 terabyte per hour equals 2 Gb/s which i'm sure will be classified as abusing.

khuongcomputer

@gsrdgrdghd said: Then you should probably read the providers TOS and AUP more carefully. They always say that you will be terminated if you abuse your allocated ressources or affect other customers. Your 1 terabyte per hour equals 2 Gb/s which i'm sure will be classified as abusing.

Not if I am on a VPS with > 2gbps burst-able (and don't tell me there's no >2gbps VPS out there). And I am sure that his capture of bandwidth usage is for July, not for a day.

Pats

@dnom said: @gsrdgrdghd said: No his VPS was used to DoS someone else. I see.. @Pats better take action now.

yeah i have to take action once i get hold of the VPS, and find out what caused the DoS if it was internal -after securing root with really strong password + lxguard + updating kloxo, and no other user also apart from root.

few more points: - No notification from the provider?? - before or after suspending? - Also i was told initially in the support ticket that it'll be reactivated on 1st, date which i believe already passed. But its still Disabled.

khuongcomputer

@Pats said: - No notification from the provider?? - before or after suspending?

If they use solusVM, you should receive a email of notification if you reach 90% bandwidth. Check your spam box, sometimes the mail goes there.

@Pats said: - Also i was told initially in the support ticket that it'll be reactivated on 1st, date which i believe already passed. But its still Disabled.

Still black out until now? Or what? Then how can you take that picture above?

Maounique

They gave him that data. But today is 2nd almost gone here, if a VPS is finishing bw, it should restart AUTOMATICALLY next month. Unless was disabled by hand. M

Pats

@Maounique said: But today is 2nd almost gone here, if a VPS is finishing bw, it should restart AUTOMATICALLY next month

yeah they told on 31st that it'll get re-activated on 1st. Now when i ask, they reply it'll be back online after i pay the next invoice (btw its due on 16th)

dont feel good in this whole episode..

hhadmin

No, You must check for the issue in your VPS . coz it will not take that much of Bw.

Pats

Thanks, things sorted out, they couldn't provide more detailed bandwidth reports. Re-activated it after 3-4 days. I searched and found that many people reported bandwidth calculation errors in hypervm, so i think it may be the case. I re-installed everything, added fail2ban also just in case DDoS again. Hope it doesn't repeat.