Source
r/sysadmin•
TrueObservations

Friend setup basic Ubuntu server to test API, our bandwidth exploded to 75 GB a day, why?

Question

My friend/roommate recently setup an Ubuntu server behind my home router to test a rest he developed API (he's learning how to code). The only port he had exposed was 2222 (revealed from a nmap scan I did), but as soon as he set it up, our internet usage spiked to 75GB a day. I promptly had him shut it down and our internet usage returned to normal.

He wasn't hosting anything but his endpoints, so it perplexes me why that would cause a 75GB daily spike in traffic.

Any ideas on why this could be?

(Background: For work, I'm a machine learning dev, so I'm used to production level software development but my experience in devops/sysadmin is pretty shallow)

Posted Aug 26, 2019, 3:20 PM UTC

110
myotherusernameismoo•

First thought that comes to mind is thats usually a port used as an alternative for ssh. Maybe he is getting hit by a bunch of brute forcing bots and his api doesn't have a system to throttle requests.

EDIT: for ssh, not to. Dumb mistake.

7
headcrap•

Brute force bots to SSH making 75GB, though? Don't think so.

Testing API.. and running that seedbox for Game of Thrones torrents.

13
myotherusernameismoo•

It's REALLY high I will give you that. Maybe there is an endpoint on the API the bots are able to call though. Most bruteforcing bots have bruteforcing for several authentication systems iirc.

​

Or like I said, there is no throttling on requests on his API and the bots are able to flood the server with traffic. Or could be a DDOS, or could be some process duplicating shit it's not supposed to. I really don't know tbh, was just first things that came to mind with services on that port. It's very commonly used for things like this (SSH, FTP, etc).

1
Dangledud•

Turn it back on and go look! Use iftop and you will be able to see where the traffic is coming from. Iftop might be on there or you might need to install a package. Either way, this will take 5 minutes.

3
TrueObservationsOP•

Thanks for the answer. Network admin is something I haven't had great experience with, so I was looking for intuition on what to do to find the solution.

Thank you!

1
the_bananalord•

Sounds like the server was compromised. Where was the traffic coming from/headed to?

2
TrueObservationsOP•

Once our data cap resets next month, I'll take a look

1
ivantsp•

At a guess: it is trying to download and install an update. But it's failing, so it is trying again, and again etc

But you really need to find out what the traffic is /was

2
[deleted]•

[deleted]

1
Ride_Nunc•

Where was port 2222 exposed? His endpoint or from outside the router? Do you have a network firewall? (pfsense or untangled) These would have logs that might help.

Local network monitor like Bitmeter OS or Etherape? This would let you see what the local traffic looks like

What is the api suppose to do? What did it really do?

1
TrueObservationsOP•

Good questions to ask, thanks for tips on approach.

1