Over the past month or so, one of my servers has gone through several attacks (just about everyday)... some that burst to 25 Mpbs.

My question is, since I suspect that many of these attacks originate from one of the other servers on my provider's network (i.e. other servers are getting DOS attacked and spill over to my server), is it legal for them to charge me for it?

If it's not legal, how am I going to determine what which traffic I'm supposed to pay for, and which ones I'm not.

If it's legal, is there any way I can stop it, besides having them install a good firewall on their side?

If the traffic is going to your network, it is your responsibility. The bandwidth costs your provider money, and therefore should cost you money as well.

I think the attacker should be paying for it.

Had the same problem and still discussions.
my former provider billed me three times more bandwith as I
have now at another place with more sites.
maybe the count of traffic is not properly?