Strange traffic pattern - What could be the reason?

linuxthefish

@exception0x876 said:
How exactly this prevents traffic from hitting the link? you drop it fine, but it still gets to the link and this is what matters.

Setting REJECT not DROP should close the connection, but I'm not 100% sure if this works with UDP. When I was getting a UDP flood from a single IP and non spoofed traffic, dropping incoming UDP on that port reduced the traffic level a ton and was beneficial.

If leaseweb has a separate firewall that can be configured, traffic hitting this that isn't passed through to the VM might not count as "used" bandwidth? I've not used them so not sure.

Amitz

2bb3 said: That would be what I understand but I don't really see why it has to be like that. Did they give you any more information @Amitz? Very strange behavior indeed. Also it's strange because you didn't have that pattern before, how come did it start some day?

No, I have not received more information than provided above and I must admit that I did not ask further questions. That Leaseweb VM is not the most important one for me. Several other servers standby to overtake its purpose, if necessary. I just wanted to be sure not to get billed for traffic that I have not caused. However: I am also under the impression that their network design might be lacking somehow when it comes to VLANs and isolation. I furthermore have no explanation why it happened from one day to another. But my general knowledge about network design is not too big. So who am I to judge?

@linuxthefish said:
If leaseweb has a separate firewall that can be configured, traffic hitting this that isn't passed through to the VM might not count as "used" bandwidth? I've not used them so not sure.

Their firewall (at least for the service that I have) seems to be quite basic. I will fiddle around with it during the festive days to see whether it can be useful to me or not.

Amitz

Small update:
I have checked out the included firewall and only allowed incoming traffic on TCP ports 80, 443 and my ssh port. Was pretty easy & straightforward. Now all incoming traffic on anything else gets blocked before it reaches the VM. Problem instantly solved, no more background noise. That's quite okay for me.

Thank you all for hints, help & support!

sin

Amitz said: Problem instantly solved, no more background noise. That's quite okay for me.

Looks like you already fixed this, was about to add in that I have 3 Leaseweb VPSes currently and use their firewall and do not experience any weird traffic. Good to see you got it fixed .