topic Re: Abnormal traffic in Open Q&A

Finding source of abnormal (high/low) traffic

Peter_Youssef — Thu, 08 Dec 2022 15:17:58 GMT

Is it possible through Dynatrace to detect the source that originates the high traffic to a host that's monitored within Dynatrace or not?

If yes, kindly tell me where / how to get the incoming traffic to a monitored host within Dynatrace.

Re: Abnormal traffic

Peter_Youssef — Thu, 08 Dec 2022 08:36:28 GMT

can we get it through Distributed traces.

Re: Abnormal traffic

pahofmann — Thu, 08 Dec 2022 08:46:34 GMT

If you are looking at a specific Host you can check Analyze Process Connections under Incoming connections:

There you can see als processes that are calling processes on your current host and the transfer rates:

If you already know the service that is getting the higher load you can use the backtrace to see who is calling that service.

Re: Abnormal traffic

Peter_Youssef — Thu, 08 Dec 2022 09:22:42 GMT

Thanks @pahofmann for clarification

Yes, we have done that and through analyze process connection you will see the requester server and the destination, mean while we have checked the services and the requests we found where organically the high traffic is coming from so we get the full picture and the list of requesters (IP Addresses).

we can do it through distributed traces but it consumes much time to get the full info.
Thank you so much for support.

Re: Abnormal traffic

AntonioSousa — Thu, 08 Dec 2022 12:40:59 GMT

@Peter_Youssef,

If it's HTTP traffic, you can set up a Request Attribute for the the reply size and Client IPs, and from there, I'm normally able to find the biggest "offenders"" through MDA.