If most traffic is inbound, I would say Carey does not have any filesharing issues, but auto update issues: the IP addresses most accessed are mostly for CDN providers, the ones used for hosting update packages. Auto updates will take a lot of traffic, especially snaps. They take a lot of space, and usually when one is updated because of a library issue, you can count on several others having the same library to release updates too. If most of this traffic is outbound, then we have a different history and something is really sending a lot of data outside. And if the traffic is more or less balanced, it's a proxy, torrent, or Tor node running. How to know? There are some programs for that: iftop, iptraf, nethogs and bmon are easy to use and powerful. Mauro https://www.maurosouza.com - registered Linux User: 294521 Scripture is both history, and a love letter from God. On Wed, Sep 24, 2025 at 4:33 PM Steve Litt via Talk <talk@lists.gtalug.org> wrote:
William Park via Talk said on Wed, 24 Sep 2025 14:03:56 -0400
On 2025-09-24 00:44, Steve Litt via Talk wrote:
Carey, I'm not an authority, but as far as I know, this kind of usage comes from unauthorized servers. The way you stop unauthorized servers dead in their tracks is to set your firewall so your only servers that can hit the Internet are on port 21 (ssh). And if you don't ssh into your Linux box, then set your firewall to block port 21 also.
That will block incoming connections. OP's problem of outgoing connections still remains.
Firewalls can be used to block both outgoing and incoming.
Now if you mean that Carey is purposefully accessing a client to a server that sends him tons of stuff, that's a different matter and the solution is to quit using that server.
SteveT
Steve Litt
------------------------------------ Description: GTALUG Talk Unsubscribe via Talk-unsubscribe@lists.gtalug.org Start a new thread: talk@lists.gtalug.org This message archived at https://lists.gtalug.org/archives/list/talk@lists.gtalug.org/message/6AWIB43...