Hi,

Now I have the raw port graphs in layeredtech, but I fail to see how I am using 30gb a day. Is there anyway I can see what files and resources have been using the most bandwidth in the past 24hrs? The server runs whm/cpanel but I am looking for something a bit more reliable.

Thanks

WHM should give you a bandwidth report that shows the usage for all accounts.

When you find the account that is using the bandwidth, then login to their cpanel account and click the "bandwidth" link. Then drill down into the detail, and it will show you what "protocol" is using the bandwidth for every day of the month...

30gig a day,
sheeesh, let me know when you find out what is happening,,, mybe rouge proxy or looping dns.

i hope you find out

chow!!

Maybe you were hacked. In shell run a netstat and see if anything is running from odd ports.

It's completely possible if you had files available to the public. We have customers easily using 8-10Mbps constant public bandwidth. So really, it's possible; then again, if the page that's being hosted is pure text, I would see if your server was compromised.

Image and videos hotlinking are likely culprits. Have you check for these?

Also, what files do you host on your dedicated?

Really all depends on what the server is being used for..

Mail, FTP, and remote DB connections usually account for allot of traffic.

Raw port graphs are usually very accurate because they are handled at router level...

My Hosted Exchange Box uses about 20Gb of bandwidth a day and thats with about 250 mailboxes...

My server uses about 80 GB for just websites that I host. I guess it really depends on what he's hosting.

With that kind of transfer it sounds like a filehost or proxy as mentioned. I would check whm and find out what user it is, then investigate into their account.

With that kind of transfer it sounds like a filehost or proxy
We get more than that in email !

zymic
ps auxf
netstat -apn
are your friends :)

try firewalling off ports you dont actually need open

then you could add counters to the ports which are valid to get more accurate transfer levels by protocol.

maybe even look at installing something like netflow to analyse the traffic

the b/w reporting in control panels is appallingly inaccurate to say the least

a quick scan of your drive for large (> 1mb) files might yield some interesting results in case you're hosting last weeks TV schedule :)