So we've been having this problem for a while now but nobody has been able to assist us. We've hired experts, paid hundreds of dollars in remote hands for multiple data centers, and posted threads on various forums without any luck so I'm reaching out to vpsBoard in the hopes that somebody might have a solution to our problem.
The problem is that an IP that was once assigned to a network interface (be it physical or virtual) continues using traffic (normally over 50Mbps, sometimes over 100Mbps). The traffic is 100% symmetrical (i.e for every Bps outbound, there is an equal Bps inbound). When we reset the NIC the traffic stops for a few minutes and then returns. The IP does not ping and is not located in any tables on the server or the routers/switches. A tcpdump shows the traffic has little in common also, sometimes it'll be ICMP traffic and sometimes it'll be packets going to port 22 even though nothing is listening on port 22 on the server even if the IP was bound to a NIC.
I've changed every setting I can think of in sysctl and we've tried different servers, switches, routers, and NICs without any luck. The only common thing is that we always run CentOS 6.x as the OS (although we've tried multiple different kernels over the months we've been working on this problem). I've used iptables to drop all packets to the IPs (source and destination) but the traffic still continues. I've even gone as far to reboot the server but the traffic returns after the server comes back online. We thought this problem was limited to OpenVZ but we had an IP bound to eth0:0 and after I removed it the traffic jumped to 140Mbps. I tested it on a KVM VPS (installed OpenVZ and set it up just like our other OpenVZ nodes) with no luck either. We used to think the problem was ARP related but this is not the case since flushing the ARP tables on the server or network devices have no effect.
I am willing to pay $200 via Paypal if somebody can explain it and provide a solution that does not involve purchasing additional equipment.
The problem is that an IP that was once assigned to a network interface (be it physical or virtual) continues using traffic (normally over 50Mbps, sometimes over 100Mbps). The traffic is 100% symmetrical (i.e for every Bps outbound, there is an equal Bps inbound). When we reset the NIC the traffic stops for a few minutes and then returns. The IP does not ping and is not located in any tables on the server or the routers/switches. A tcpdump shows the traffic has little in common also, sometimes it'll be ICMP traffic and sometimes it'll be packets going to port 22 even though nothing is listening on port 22 on the server even if the IP was bound to a NIC.
I've changed every setting I can think of in sysctl and we've tried different servers, switches, routers, and NICs without any luck. The only common thing is that we always run CentOS 6.x as the OS (although we've tried multiple different kernels over the months we've been working on this problem). I've used iptables to drop all packets to the IPs (source and destination) but the traffic still continues. I've even gone as far to reboot the server but the traffic returns after the server comes back online. We thought this problem was limited to OpenVZ but we had an IP bound to eth0:0 and after I removed it the traffic jumped to 140Mbps. I tested it on a KVM VPS (installed OpenVZ and set it up just like our other OpenVZ nodes) with no luck either. We used to think the problem was ARP related but this is not the case since flushing the ARP tables on the server or network devices have no effect.
I am willing to pay $200 via Paypal if somebody can explain it and provide a solution that does not involve purchasing additional equipment.
