I am building a website and there are no users yet.

Odd thing is, every 2 hours I see a peak in IPv6 traffic:

enter image description here

I am concerned someone is polling my server for nefarious reasons. Am I right to be worried?

I am connected to the server using putty and FileZilla. Do they send a 'heartbeat'?

  • What's in your logs? An IPv6 request should stand out like a sore thumb. Anyway, this level of traffic is so trivially low that I would probably not worry about it much. May 15 '13 at 22:41
  • Looks like a keep alive, since its in the bits/sec its absolutely nothing to worry about. May 15 '13 at 23:17
  • A google search indicates this is normal if you're on Linode. You can use tcpdump if you really want to see what it is. Mar 30 '14 at 18:36

Usually, I would assume this is a ping from your host's monitoring server to see if your server is online and responding. You can add logging to IPv6 this with ip6tables, for a look.

# LOGGING is a chain redirected from INPUT for testing
ip6tables -A LOGGING -j LOG --log-prefix="IPv6 Packet: "

If you wanted a detailed outline of what this traffic actually is, you can set up Wireshark or another packet-capturing tool on the server to find this out. Failing that, however, someone polling your server is hardly "nefarious". The level is actually unusually low.

It could also be TCP KeepAlives from your clients to the server. Do some research; there's not more we can say about this without log details.

EDIT: Actually, I noticed that all of the traffic on that graph is internal (private/priv). There's nothing wrong with it, and it's likely services communicating with each other, either on localhost or inside the computer's internal network.

It's quite likely those are IPv6 MULTICAST packets being sent every two hours

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.