How to identify suspicious traffic

Quick answer: Start with ss -s for the connection summary, list top source IPs with ss -tn, watch live bandwidth with iftop or vnstat, and check web access logs for repetitive patterns. Suspicious traffic shows up as abnormal counts: too many connections from one place, or too many identical requests from many places.

Overview

Whether it is a brute-force campaign, a scraping bot or the start of a DDoS, malicious traffic distorts normal distributions. You do not need deep packet inspection to spot it — connection tables, bandwidth meters and access logs reveal most patterns in minutes.

Before you start

• Root/sudo access; install the helpers once: apt install iftop vnstat -y (or dnf equivalents).
• A sense of your normal baseline — connections at a busy hour, typical Mbps.

Step-by-step guide

1. Summary first:

   ss -s

   Thousands of TCP connections where you normally have dozens is the red flag.
2. Top source IPs:

   ss -tn state established | awk 'NR>1 {split($4,a,":"); print a[1]}' | sort | uniq -c | sort -rn | head

   (Column 4 is the remote peer on most ss versions — verify on yours.)
3. Half-open connections (SYN flood sign):

   ss -tn state syn-recv | wc -l

4. Live bandwidth: iftop -n shows who consumes the link right now; vnstat -l gives totals.
5. Web logs: top clients and top URLs:

   awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head

   Identical URL hammered by many IPs = Layer 7 flood; one IP crawling everything = scraper.
6. Act on findings: rate-limit or block at the firewall, and for floods follow the DDoS reporting guide.

Common issues

• Blocking shared IPs: a NAT gateway or CDN edge can look like an attacker — check reverse DNS and volume per URL before banning.
• Reading only totals: low bandwidth with huge connection counts is still an attack (protocol-level).
• No baseline: set up vnstat today; "is this normal?" needs history to answer.

When to contact support

When counts point to a flood you cannot absorb, or traffic patterns saturate the link, report it — include the command outputs you gathered; they shortcut diagnosis.

Frequently asked questions

What is the quickest sign of abnormal traffic?

The output of ss -s: if TCP connection counts are ten or a hundred times your normal baseline, something automated is hitting the server and deserves investigation.

How do I see which IPs open the most connections?

List established sockets with ss -tn, extract the peer address column and count occurrences — the one-liner in this guide prints the top talkers sorted by connection count.

A single IP downloads my whole site — attack or not?

Usually a scraper or crawler rather than an attack. Check its reverse DNS: legitimate search bots identify themselves, and unknown aggressive crawlers can simply be rate-limited or blocked.

Related articles

• How to report a DDoS attack
• How to read auth logs
• What is a DDoS attack?
• How to configure a firewall

Need a hand? Contact Cloud2Y support →