Why did the server start clogging traffic?

Question

Nginx

Hello everyone, I have a strange situation. In general, I have a server at home. I keep it for a couple of sites and in general everything is fine and it was the 23rd day of uptime. But then I decided to check my settings and asked the guys to trumpet me. In general, I have nginx, Cloudflare (Free), iptables I didn’t touch it by default and you know everything was cool. We started the attack, everything is fine, the cloud is blocking, but I see the site began to squat a little, I turned on the check for cookies in the cloud on the fly. everything is great. no drawdowns, nothing. BUT monitoring netstat I got literally 50 connections from 1 ip but from different subnets. And I didn’t pay attention to this, well, I think maybe the guy still wants to finish it off. (Although he told me that he had stopped), but that’s not the point. After a couple of minutes, my network stupidly falls. What is the problem, I did not understand at all. The funny thing is that according to the indicator on the switch, I see that my server makes a terrible return, well, that is, an upload from the server side. I pull out the LAN cord from it, everything is fine, the Internet works again, everything is cool, I insert the wire back, the Internet drops again and I see that the server is terribly eating traffic. Unfortunately, I couldn’t go to the server (Because I couldn’t get access via sssh because of the Internet, but for some reason the keyboard didn’t work directly and the monitor didn’t wake up) Actually, dear question, why did this happen? What was it all about? Tipo the server screened requests or how to understand it correctly. And if anything, I would be very grateful for a hint on how to solve this and avoid this next time. I insert the wire back, the Internet drops again and I see that the server is terribly eating traffic. Unfortunately, I couldn’t go to the server (Because I couldn’t get access via sssh because of the Internet, but for some reason the keyboard didn’t work directly and the monitor didn’t wake up) Actually, dear question, why did this happen? What was it all about? Tipo the server screened requests or how to understand it correctly. And if anything, I would be very grateful for a hint on how to solve this and avoid this next time. I insert the wire back, the Internet drops again and I see that the server is terribly eating traffic. Unfortunately, I couldn’t go to the server (Because I couldn’t get access via sssh because of the Internet, but for some reason the keyboard didn’t work directly and the monitor didn’t wake up) Actually, dear question, why did this happen? What was it all about? Tipo the server screened requests or how to understand it correctly. And if anything, I would be very grateful for a hint on how to solve this and avoid this next time.
PS it's a pity uptime =(although it was small, well, it's lousy at heart.

Answer 1

Start by learning atop

Answer 2

Not a single uptime ... 8)
Did you change network settings in the process on the server?
And it wouldn't hurt to check for rootkits.