I recently split some video using ffmpeg on my Linode. Why did my network usage spike?

Why would an internal process cause my CPU, I/O, and outbound networking to spike?

I took a look at ffmpeg.org and do not see any thing about this software that would cause network usage. It would explain the heavy CPU usage and I/O activity however. I originally thought that one of the codecs might have been using an external service to assist with its processing, but I do not see anything about ffmpeg that would cause this to happen.

Is it possible that your Linode was serving the files. Were you viewing the video while you were splitting it?

Were you using SSH during the processing and did the processing produce a large amount of logging on your terminal?

Perhaps you may find a clue in your /var/log/messages file.

Is my Linode using SAN storage? Does SAN storage count towards networking usage?

Linode BlockStorage works over the network, so if you were writing to a Block Storage Volume, it would produce network traffic on the local network, but this would not appear or be counted against your outbound transfer pool.

You can see if you have any Linode BlockStorage volumes by looking at your Linode's dashboard or Linodes List, and clicking "Manage Volumes".

If you were using your Linode's Disks, you would not see any network traffic for disk access.

It seems very likely that some other process was responsible for the network traffic.

Some other possibilities

• Can you run ss -tulpn to see what processes are associated with which network ports on your Linode. Perhaps there is some other service that it producing the network.

• Do you have more than one user account on your Linode? Is it possible that another user's activity might account for the network usage?

• Is it possible that some installed service like a web server was compromised and a malicious actor was using your server for some other purpose? What do you see if you browse your Linode with a web browser?