I have 2 servers running in AWS, both are running Redis and the Data-Dog client. I just looked at our bill and see that we had 800GB of NetworkOut data. I've narrowed down the traffic to these 2 machines specifically, each one is doing about 10GB of traffic / day. I'm not sure why at this point and need to figure out to determine what this data is.
Could you suggest some techniques or applications that would help me determine which applications would be exfiling data, and perhaps to where.
For the record the data we store in redis on these machines is nothing more than a sequence number for synchronizing processing across several other machines, it is a single int x about 100k keys.
I should mention that our inbound firewall settings only allow Inbound communications from the IP block we own. I dont have any reason to suspect anything nefarious is happening, but I need to track it down to see if we can reduce it.
We've considered just setting up a tcpdump for outbound data but we have very small HDs on these instances, so there is a concern about filling them up too quickly.