You can use apt install module_name to install those modules inside SSH.

If you are doing anything that requires big amounts of data being sent, then that amount is fine by modern standards.

The thing is my server is doing nothing at this moment, it shouldn't send any data at all.

Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
E: Unable to locate package netstat

this happens for every package I try to install. I think railway cuts the access to repos for security reasons

Check your connections to external services. If you connect your server to an external db or another service, this could be your problem. If you have connection retry on fail this might be causing the server to retry connections indefinitely.

Recommended Next Steps

​Check the Logs: Look for repeating error messages.

​Verify Private Networking: If you have multiple services on Railway talking to each other, ensure they are using the RAILWAY_PRIVATE_DOMAIN

​Check Environment Variables: Ensure DATABASE_URL or any other env vars you might have are correct. If the app can't connect, it might retry indefinitely.

Thank you for your reply!

I use only internal services. My server fetches data from Google, but on demand, which doesn't happen that often.

No related error messages found.

The database is connected via internal address, so we can cross that out too

first run apt update before installing anything. the package cache is empty. then do apt install net-tools nethogs -y

second , the most common cause of high egress on railway is using public urls instead of private network. even between your own services, if you're using public urls (.up.railway.app or similar), railway charges egress fees. but private network (.railway.internal) is completely free

check all your database connections and service urls , make sure they're using .railway.internal domains, not public urls. this is probably your issue since you said the server is doing nothing but still sending data

also check railway dashboard -> account/usage -> "view cost by service" to see exactly which service is causing the egress

that spike at 9:45am looks like either a scheduled task or a connection retry loop. check your logs with ps aux and look for any background processes

i hope this help you

Thanks so much!

I have a job that uploads data to typesense every 5 minutes, but it does via internal URL.

Here are my settings:

const client = new Typesense.Client({
  nodes: [
    {
      host: 'typesense',
      protocol: 'http',
      port: 8108,
    },
  ],
  apiKey,
});

and my typesense instance (located in the same project) is renamed to "typesense" so my server could find it:

But when I commented out this job, public network traffic of the server went down to almost zero:

I guess that makes question somewhat answered, I will mark it as resolved.

But if you have any idea why this traffic is considered public by the Railway, it would help even more.

Thanks in advance!