Ok I can understand a 10-20% difference in traffic for them, but I show 5gigs of transfer from one ip yesturday and httpd logs shows that ip has only done that for the whole month(average 500meg a day) Now yeah I was thinking it could be ftp, but the guy has nothing in his directory, only 10megs worth of webfiles. Any ideas?

Thanks

Mail?

I considered that to...but 3gigs worth of mail in one day?

You'd be surprised. We have one client who receives 2000+ messages/day. She's quite the fan of mailing lists, and her mail total the other day was almost 400M. Quite a bit flowing in and out. Of course, you could take the other tack and see if he has any spam scripts up there. Other option: pr0n or warez that has subsequently been taken down.

Are you sure that the IP used is dedicated? if not, the traffic reflects total usage by all those who share the IP.

If it is a unique IP, I would check domlogs of all domains hosted on the server to see if someone has been using this person's IP to pass on the traffic to that person's account! Say you have user xyz who uses abc's ip like
this: http://xxx.xxx.xxx.xxx/~xyz/blah.html this would
count against the owner of the IP (abc) although it is
serving content for xyz! Not very common but one possibility to look into.

Oh, yeah! Third party servers - good call. :)

Thanks for all the replies :) It is a dedicated ip to that domain and there is only 1 other domain on the server which is mine so I know its not eating the bandwidth up. Could be ftp/email combined im sure since I dont know what they use the ftp for, nore do I care as long as it is legal,since pay per gig =) While on this subject, are there any other bandwidth tracking programs besides ipfm that are halfway decent since ipfm is pretty lame.


Thanks a ton

Sure, the Multi Router Traffic Grapher

http://people.ee.ethz.ch/~oetiker/webtools/mrtg/mrtg.html~