Network Traffic Monitoring

How Network Monitoring Works

Server Scout's network monitoring provides real-time insights into your server's network performance by tracking bandwidth usage and interface health. The monitoring agent automatically collects network statistics every 5 seconds, giving you detailed visibility into traffic patterns and potential issues.

The agent reads data directly from /proc/net/dev, a kernel interface that exposes network interface statistics. This lightweight approach ensures minimal system overhead whilst providing accurate, up-to-date metrics for all network interfaces on your system.

Data Collection Process

Server Scout focuses on monitoring your server's primary network interface, typically eth0 or the interface with the default route. Every 5 seconds, the agent extracts two key metrics from /proc/net/dev:

• rx_bytes: Total bytes received on the interface
• tx_bytes: Total bytes transmitted from the interface

These cumulative counters represent the total network activity since the interface was brought online. To provide meaningful throughput metrics, Server Scout calculates the rate of change between readings.

Rate Calculations

Network throughput rates are determined by calculating deltas between consecutive readings:

RX Rate = (current_rx_bytes - previous_rx_bytes) / time_interval
TX Rate = (current_tx_bytes - previous_tx_bytes) / time_interval

With readings taken every 5 seconds, this provides near real-time bandwidth utilisation data. The rates are typically displayed in bytes per second (B/s) or converted to more readable units like KB/s, MB/s, or GB/s depending on the traffic volume.

Error Monitoring

Beyond basic throughput monitoring, Server Scout offers an optional net_errors metric that tracks interface-level errors. This metric combines several error counters from /proc/net/dev, including:

• Receive errors and dropped packets
• Transmit errors and dropped packets
• Collision and carrier errors

To enable error monitoring, add the following to your agent configuration:

metrics:
  net_errors: true

This metric helps identify network hardware issues, driver problems, or network congestion that might not be apparent from throughput data alone.

Viewing Network Data

Network performance data is accessible through the server detail page in your Server Scout dashboard. The network graphs display:

• Inbound throughput: Data received by your server (RX rate)
• Outbound throughput: Data transmitted from your server (TX rate)
• Interface errors: When enabled, shows error rates over time

The graphs provide multiple time ranges, from real-time 5-minute views to historical data spanning days or weeks, helping you identify both immediate issues and longer-term trends.

Identifying Bandwidth Issues

Server Scout's network monitoring helps identify several common bandwidth problems:

Sudden Traffic Spikes

Sharp increases in network activity often indicate:

• DDoS attacks or unusual traffic patterns
• Backup operations or large file transfers
• Application issues causing excessive network requests

Look for dramatic increases in either inbound or outbound traffic that don't correlate with normal usage patterns.

Sustained High Usage

Consistently high bandwidth utilisation might suggest:

• Insufficient network capacity for current workloads
• Applications with inefficient network usage
• Background processes consuming excessive bandwidth

Monitor baseline usage patterns to establish normal ranges and identify when usage exceeds typical levels.

Asymmetric Traffic Patterns

Unusual ratios between inbound and outbound traffic can indicate:

• High inbound, low outbound: Potential data ingestion issues or incoming attacks
• High outbound, low inbound: Possible data exfiltration or misconfigured services
• Sudden pattern changes: Application behaviour changes or security incidents

Troubleshooting Tips

When investigating network issues:

1. Correlate with other metrics: Check CPU and memory usage during network spikes
2. Review error rates: High error counts often indicate hardware or driver issues
3. Compare historical data: Identify if issues are recurring or one-off events
4. Monitor multiple timeframes: Use different graph ranges to understand issue duration

By combining Server Scout's network monitoring with system-level investigation, you can quickly identify and resolve bandwidth-related performance issues before they impact your users.