Puzzle! webmaster try to solve this.

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • debbieN
    Confirmed User
    • Jan 2003
    • 1193
    #1

    Puzzle! webmaster try to solve this.

    my bandwidth usage has increase for one of my servers by 250% per day over the last 18 days.

    all my tracking services have not shown more than an increase of 10% of all unique hits (TGPs, SE, Toplists, Directories). So none of the normal traffic has produced this dramatic increase.

    Also, this was not a gradual build up it was an instant spike that has not changed.

    So far easyservermanagement has not found the problem.

    They say that no one has penetrated the server's firewall or anti-hacking protocals.

    Unforturately I am not server savey and do not know how to access my ftp log files to figure this out.

    any thoughts.

    don't rent the top room at the Luxor
    ______________________


    Debbie Nomad's Evil Hobby
    Tags: None
    • Hue G. Pness
      Confirmed User
      • Jun 2003
      • 1237
      #2
      someone hot linking some movies or something maybe?
      GFY Voice of Reason

        Comment

        • riosluts
          Confirmed User
          • Sep 2003
          • 5250
          #3
          umm go to yourdomain.com/stats or /webalizer and then check your logs

            Comment

            • Jizzman
              Confirmed User
              • Aug 2001
              • 379
              #4
              login using an ssh program like putty (its free, search for it) right after you login type 'top' (without the quotes) this will show your cpu load and what programs are using what resources etc. There will be some numbers across the top, this is your cpu load, if any of them are over 10 or so you might have some issues. Also look for anything strange that might be using your resources up (ie sql hogging all your resources.) This is just a quick starting point, hope this helps

                Comment

                • debbieN
                  Confirmed User
                  • Jan 2003
                  • 1193
                  #5
                  I do not have movies, which would make sense if I did.

                  They would have had to hotlink thousands of pics and generate 2.5 times the amount of traffic I usually get per day.

                  One dramatic spike and I has not gone down yet.

                  I had webalizer installed but it was removed after the last hacker attack. I will get this reinstalled wednesday.

                  Other than easyservermanagment who do you use that can find these things out?
                  don't rent the top room at the Luxor
                  ______________________


                  Debbie Nomad's Evil Hobby

                    Comment

                    • Ash@phpFX
                      Confirmed User
                      • Nov 2003
                      • 4292
                      #6
                      my guess would be hotlinking also, do you have protection set up?

                        Comment

                        • debbieN
                          Confirmed User
                          • Jan 2003
                          • 1193
                          #7
                          hot linking would be difficult for such a large amount of bandwidth increase - unless they are using it for TGPs.

                          I never thought that someone would use my TGP posts to resubmit to TGPs. That might be possible.

                          that might be the problem.

                          since all my tgp galleries are permanent they are out there for hotlinking.

                          damn.
                          don't rent the top room at the Luxor
                          ______________________


                          Debbie Nomad's Evil Hobby

                            Comment

                            • raster
                              Confirmed User
                              • Aug 2003
                              • 784
                              #8
                              Originally posted by debbieN
                              hot linking would be difficult for such a large amount of bandwidth increase - unless they are using it for TGPs.

                              I never thought that someone would use my TGP posts to resubmit to TGPs. That might be possible.

                              that might be the problem.

                              since all my tgp galleries are permanent they are out there for hotlinking.

                              damn.
                              Might be worthwhile putting some protection in place to prevent this

                                Comment

                                • HS-Trixxxia
                                  Confirmed User
                                  • Mar 2002
                                  • 2946
                                  #9
                                  Well if you're able to check your traffic sources, you should be able to see if they are hotlinking or if someone is sending you a tremendous amount of traffic, right? So if all your programs say it's not an increase in traffic - what does your host say it is?

                                  ~~♥~~♥~~♥~~♥~~♥~~♥~~♥~~♥~~
                                  Patrizia
                                  COO - ♥ MassiveDollars
                                  Email: patrizia at MassiveDollars dot com
                                  ICQ: 465.826.441 Yahoo: trixxxia_me MSN: trixxxia at hotmail dot com

                                    Comment

                                    • jmk
                                      Confirmed User
                                      • Sep 2002
                                      • 5391
                                      #10
                                      Yeah figure it out with your logs
                                      and redirect that traffic

                                        Comment

                                        • KobyBoy
                                          Confirmed User
                                          • Jul 2003
                                          • 201
                                          #11
                                          Don't know how comfy you are with the command prompt. I assume we are talking about a Linux box so this is going to be a Linux tip. There's a program call IPLog that once you install can monitor your network. It keeps a record of who's accessing your machine and which port/protocol they are using. You might want to give that a try. You can find IPLog here: (http://ojnk.sourceforge.net/)

                                            Comment

                                            • sumphatpimp
                                              Confirmed User
                                              • Aug 2002
                                              • 5235
                                              #12
                                              they could be sending spam through your server.

                                              just hack in and install whatever software is needed and spam away.

                                              and you hold the bag for it.


                                              nothing but profit for them.

                                              you just have to check your logs for unusual activety and see if you have any scrpts you don't recognise, and what are they chmod for, can you get into them?


                                              good luck

                                                Comment

                                                • Azathoth
                                                  Confirmed User
                                                  • Nov 2002
                                                  • 217
                                                  #13
                                                  Originally posted by debbieN
                                                  my bandwidth usage has increase for one of my servers by 250% per day over the last 18 days.

                                                  all my tracking services have not shown more than an increase of 10% of all unique hits (TGPs, SE, Toplists, Directories). So none of the normal traffic has produced this dramatic increase.

                                                  Also, this was not a gradual build up it was an instant spike that has not changed.

                                                  So far easyservermanagement has not found the problem.

                                                  They say that no one has penetrated the server's firewall or anti-hacking protocals.

                                                  Unforturately I am not server savey and do not know how to access my ftp log files to figure this out.

                                                  any thoughts.
                                                  Could be any number of things tho if I were you i'd be installing a package to
                                                  record what kind of data you server is seeing ( something like net-acct for
                                                  Linux servers ).

                                                  That way you can tell your utilization isn't bullshit ( i wouldn't always trust
                                                  your hosting provider ) and you can idenfity what the traffic is.

                                                  - Az

                                                    Comment

                                                    • Fukeneh
                                                      Confirmed User
                                                      • Mar 2004
                                                      • 1245
                                                      #14
                                                      server got cracked?

                                                        Comment

                                                        • debbieN
                                                          Confirmed User
                                                          • Jan 2003
                                                          • 1193
                                                          #15
                                                          thank to all.

                                                          agian excellent answers.

                                                          I let you know when I fix this problem.
                                                          don't rent the top room at the Luxor
                                                          ______________________


                                                          Debbie Nomad's Evil Hobby

                                                            Comment

                                                            Previous template Next
                                                            Working...