help me track down bandwidth thief - take 2
our mrtg graph shows that incoming bandwidth usage on one of our servers has increased from average (95th percentile) 100kbps to 600kbps over the past month.
Looking at the graph, it's quite obvious this extra incoming traffic started about 4 weeks ago and has been consistently high (goes up and down, it' not constant) and average 600kbit or so (for incoming, outgoing is irrelevant..)
Most people here would think who cares ..it's only 0.5mbit, but where we are that costs us an extra $500 a month
I've looked in ps output (ps auxfw) and there's nothing unusual .. no excessive processes.
netstat also doesn't show a lot of connections .. it's all normal.
iptraff also isn't telling me anything...
Part of the problem I guess is that the 'extra' traffic usage isn't high enough to stand out from normal traffic but it still hurts
Can anyone recommend any good ways of tracking down where most of this traffic is going?
Watching iptraf over the last hour, I see most of the incoming traffic is going to the server's shared IP, httpd's port (80) ...
Ideas? Suggestions?
