Linux VM has high network traffic even though it's idle

Zsolt Safrany 1

I have an idle Linux (ubuntu 18.04) VM. Idle means that currently I'm not doing anything with it; I haven't started/installed any app on it that would create network traffic.

Yet, when I look at the network metrics I see that the VM receives 400-500 MB and sends 300-400 MB of data on average per day.

Seems like a lot of traffic even though the VM is idle.

Is this amount of traffic expected on a Linux VM? What could be the source of this traffic?

prmanhas-MSFT 17,901 Reputation points Microsoft Employee

2020-11-02T10:42:16.513+00:00

@Zsolt Safrany Can you please enable NSG flow logs which is attached to the VM.

You can refer to below article as well to understand how to collect logs:

https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal

Once we have this information we can see what's going on with traffic analytics.

Do let me know in case of any queries.
Zsolt Safrany 1 Reputation point

2020-11-29T23:23:28.697+00:00

Sorry, I didn't notice your reply - I was not receiving notifications.

I enabled nsg flow logging as you suggested just now; will get back in a few days with results.
Zsolt Safrany 1 Reputation point

2020-11-30T01:34:08.45+00:00

Now I see what's creating that traffic:

My VM communicates with IPs (through port 443 (https)):

East US (40.71.12.250)
East US (40.79.154.83)
East US (20.60.7.134)

(inbound and outbound bytes are roughly the same)

Based on ipgeolocation.io these IPs belong to Microsoft Corporation. What can this traffic be about?

Share via

Linux VM has high network traffic even though it's idle

Your answer