Troubleshoot high network bandwidth on Linux instances

Step 1: Identify the high-traffic network interface

Use the sar tool to identify the high-traffic NIC and define the troubleshooting target.

1. Log on to the Simple Application Server instance using a rescue connection.

   2. Go to the Servers page in the Simple Application Server console.

   3. On the server card, click Connect. In the Rescue Logon section of the dialog box, click Log on Now. Enter your username and password to log on to the Simple Application Server instance.

3. Gather network interface statistics.

   # -n DEV: Reports network device statistics
   # 1 5: Samples every 1 second for a total of 5 times
   sudo sar -n DEV 1 5

5. Identify the high-traffic NIC.

   Focus on the Average value of txkB/s (average outbound bandwidth). By comparing the values, find the IFACE (NIC name) with the highest value.

   rxkB/s represents the average inbound bandwidth rate.

   Linux 5.10.134-19.1.al8.x86_64 (iZbp1e5xxx)                    11/14/2025      _x86_64_        (2 CPU)
   04:11:13 PM     IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s   %ifutil
   04:11:14 PM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
   04:11:14 PM      eth0    317.00    580.00     21.36    933.00      0.00      0.00      0.00      0.00
   04:11:14 PM      eth1      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
   04:11:14 PM     IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s   %ifutil
   04:11:15 PM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
   04:11:15 PM      eth0    328.00    582.00     22.34    943.08      0.00      0.00      0.00      0.00
   04:11:15 PM      eth1      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
   04:11:15 PM     IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s   %ifutil
   04:11:16 PM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
   04:11:16 PM      eth0    352.00    595.00     24.08    935.58      0.00      0.00      0.00      0.00
   04:11:16 PM      eth1      1.00      1.00      0.04      0.04      0.00      0.00      0.00      0.00
   04:11:16 PM     IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s   %ifutil
   04:11:17 PM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
   04:11:17 PM      eth0    347.00    581.00     23.58    943.02      0.00      0.00      0.00      0.00
   04:11:17 PM      eth1      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
   04:11:17 PM     IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s   %ifutil
   04:11:18 PM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
   04:11:18 PM      eth0    367.00    623.00     24.98    952.79      0.00      0.00      0.00      0.00
   04:11:18 PM      eth1      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
   Average:        IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s   %ifutil
   Average:           lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
   Average:         eth0    342.20    592.20     23.27    941.49      0.00      0.00      0.00      0.00
   Average:         eth1      0.20      0.20      0.01      0.01      0.00      0.00      0.00      0.00

   In this example, the eth0 NIC has the highest txkB/s value. Therefore, eth0 is the high-traffic NIC.

Step 2: Identify the peer IP address and the process that consume the bandwidth

Step 3: Resolve the high-traffic issue

Choose a solution based on the process, peer IP address, or traffic pattern that you identified in Step 2:

• If an identified process, such as a download tool (wget or curl) or an unknown program, exhibits suspicious behavior or communicates with a malicious peer IP address:

  • Terminate the suspicious process — Run sudo kill -15 <PID> to end the suspicious process. Replace <PID> with the PID of the high-traffic process that you identified.

    Important

    Before you end the process, make sure that it is not a core business process to avoid service interruptions.

  • Block the malicious IP address — Set up a firewall to block access from the malicious IP address.

  • Scan for and remove malware — Use the virus scan feature of Security Center to perform a full scan of the instance and remove malware.

• If external clients send invalid requests to the public-facing ports of the instance and saturate its inbound bandwidth:

  • Add DDoS protection — To strengthen protection against network attacks, use Anti-DDoS Origin or Anti-DDoS Pro and Anti-DDoS Premium, and then configure protected objects and mitigation policies.

• If the high traffic comes from a legitimate business process:

  • Optimize the program — Check whether your business code can be optimized. For example, reduce unnecessary data transfers, add caching, or compress data.

  • Throttle the traffic — If your business allows, use tools such as iptables to limit the traffic rate for specific IP addresses or ports, so that a single user or service does not consume all available bandwidth.

  • Move to an ECS instance — If the instance can no longer handle your normal service traffic, switch to an ECS instance. When you switch to an ECS instance, see Migrate data from a Simple Application Server instance to an ECS instance to migrate your data.

Step 4: Verify that bandwidth usage returns to normal

After you apply a remedy, run sudo sar -n DEV 1 5 again and compare the Average value for the high-traffic NIC with the value that you observed in Step 1. Check txkB/s (average outbound bandwidth) if the high traffic is outbound, or rxkB/s (average inbound bandwidth) if invalid requests saturate the inbound bandwidth of the instance. A significantly lower value indicates that the remedy took effect. If the value remains high, return to Step 2 to identify the peer IP address or process that now consumes the bandwidth.