Puzzle! webmaster try to solve this. - GoFuckYourself.com

debbieN · 03-16-2004, 09:00 PM

my bandwidth usage has increase for one of my servers by 250% per day over the last 18 days.

all my tracking services have not shown more than an increase of 10% of all unique hits (TGPs, SE, Toplists, Directories). So none of the normal traffic has produced this dramatic increase.

Also, this was not a gradual build up it was an instant spike that has not changed.

So far easyservermanagement has not found the problem.

They say that no one has penetrated the server's firewall or anti-hacking protocals.

Unforturately I am not server savey and do not know how to access my ftp log files to figure this out.

any thoughts.

Hue G. Pness · 03-16-2004, 09:02 PM

someone hot linking some movies or something maybe?

riosluts · 03-16-2004, 09:02 PM

umm go to yourdomain.com/stats or /webalizer and then check your logs

Jizzman · 03-16-2004, 09:11 PM

login using an ssh program like putty (its free, search for it) right after you login type 'top' (without the quotes) this will show your cpu load and what programs are using what resources etc. There will be some numbers across the top, this is your cpu load, if any of them are over 10 or so you might have some issues. Also look for anything strange that might be using your resources up (ie sql hogging all your resources.) This is just a quick starting point, hope this helps

debbieN · 03-16-2004, 09:11 PM

I do not have movies, which would make sense if I did.

They would have had to hotlink thousands of pics and generate 2.5 times the amount of traffic I usually get per day.

One dramatic spike and I has not gone down yet.

I had webalizer installed but it was removed after the last hacker attack. I will get this reinstalled wednesday.

Other than easyservermanagment who do you use that can find these things out?

Ash@phpFX · 03-16-2004, 09:22 PM

my guess would be hotlinking also, do you have protection set up?

debbieN · 03-16-2004, 09:30 PM

hot linking would be difficult for such a large amount of bandwidth increase - unless they are using it for TGPs.

I never thought that someone would use my TGP posts to resubmit to TGPs. That might be possible.

that might be the problem.

since all my tgp galleries are permanent they are out there for hotlinking.

damn.

raster · 03-16-2004, 10:29 PM

Quote:

Originally posted by debbieN
hot linking would be difficult for such a large amount of bandwidth increase - unless they are using it for TGPs.

I never thought that someone would use my TGP posts to resubmit to TGPs. That might be possible.

that might be the problem.

since all my tgp galleries are permanent they are out there for hotlinking.

damn.

Might be worthwhile putting some protection in place to prevent this

HS-Trixxxia · 03-16-2004, 10:38 PM

Well if you're able to check your traffic sources, you should be able to see if they are hotlinking or if someone is sending you a tremendous amount of traffic, right? So if all your programs say it's not an increase in traffic - what does your host say it is?

jmk · 03-16-2004, 10:47 PM

Yeah figure it out with your logs
and redirect that traffic

KobyBoy · 03-16-2004, 10:57 PM

Don't know how comfy you are with the command prompt. I assume we are talking about a Linux box so this is going to be a Linux tip. There's a program call IPLog that once you install can monitor your network. It keeps a record of who's accessing your machine and which port/protocol they are using. You might want to give that a try. You can find IPLog here: (http://ojnk.sourceforge.net/)

sumphatpimp · 03-16-2004, 11:00 PM

they could be sending spam through your server.

just hack in and install whatever software is needed and spam away.

and you hold the bag for it.

nothing but profit for them.

you just have to check your logs for unusual activety and see if you have any scrpts you don't recognise, and what are they chmod for, can you get into them?

good luck

Azathoth · 03-16-2004, 11:14 PM

Quote:

Originally posted by debbieN
my bandwidth usage has increase for one of my servers by 250% per day over the last 18 days.

all my tracking services have not shown more than an increase of 10% of all unique hits (TGPs, SE, Toplists, Directories). So none of the normal traffic has produced this dramatic increase.

Also, this was not a gradual build up it was an instant spike that has not changed.

So far easyservermanagement has not found the problem.

They say that no one has penetrated the server's firewall or anti-hacking protocals.

Unforturately I am not server savey and do not know how to access my ftp log files to figure this out.

any thoughts.

Could be any number of things tho if I were you i'd be installing a package to
record what kind of data you server is seeing ( something like net-acct for
Linux servers ).

That way you can tell your utilization isn't bullshit ( i wouldn't always trust
your hosting provider

) and you can idenfity what the traffic is.

- Az

Fukeneh · 03-16-2004, 11:20 PM

server got cracked?

debbieN · 03-17-2004, 07:42 PM

thank to all.

agian excellent answers.

I let you know when I fix this problem.

03-16-2004, 09:00 PM	#1
debbieN Confirmed User Join Date: Jan 2003 Location: FL, NC(I burned this down), MI Posts: 1,193	Puzzle! webmaster try to solve this. my bandwidth usage has increase for one of my servers by 250% per day over the last 18 days. all my tracking services have not shown more than an increase of 10% of all unique hits (TGPs, SE, Toplists, Directories). So none of the normal traffic has produced this dramatic increase. Also, this was not a gradual build up it was an instant spike that has not changed. So far easyservermanagement has not found the problem. They say that no one has penetrated the server's firewall or anti-hacking protocals. Unforturately I am not server savey and do not know how to access my ftp log files to figure this out. any thoughts. __________________ don't rent the top room at the Luxor ______________________ Debbie Nomad's Evil Hobby

03-16-2004, 09:02 PM	#2
Hue G. Pness Confirmed User Join Date: Jun 2003 Location: Variable Posts: 1,237	someone hot linking some movies or something maybe? __________________ GFY Voice of Reason

03-16-2004, 09:02 PM	#3
riosluts Confirmed User Join Date: Sep 2003 Posts: 5,250	umm go to yourdomain.com/stats or /webalizer and then check your logs __________________

03-16-2004, 09:11 PM	#5
debbieN Confirmed User Join Date: Jan 2003 Location: FL, NC(I burned this down), MI Posts: 1,193	I do not have movies, which would make sense if I did. They would have had to hotlink thousands of pics and generate 2.5 times the amount of traffic I usually get per day. One dramatic spike and I has not gone down yet. I had webalizer installed but it was removed after the last hacker attack. I will get this reinstalled wednesday. Other than easyservermanagment who do you use that can find these things out? __________________ don't rent the top room at the Luxor ______________________ Debbie Nomad's Evil Hobby

03-16-2004, 09:30 PM	#7
debbieN Confirmed User Join Date: Jan 2003 Location: FL, NC(I burned this down), MI Posts: 1,193	hot linking would be difficult for such a large amount of bandwidth increase - unless they are using it for TGPs. I never thought that someone would use my TGP posts to resubmit to TGPs. That might be possible. that might be the problem. since all my tgp galleries are permanent they are out there for hotlinking. damn. __________________ don't rent the top room at the Luxor ______________________ Debbie Nomad's Evil Hobby

03-16-2004, 09:11 PM	#4
Jizzman Confirmed User Join Date: Aug 2001 Location: Canada Posts: 379	login using an ssh program like putty (its free, search for it) right after you login type 'top' (without the quotes) this will show your cpu load and what programs are using what resources etc. There will be some numbers across the top, this is your cpu load, if any of them are over 10 or so you might have some issues. Also look for anything strange that might be using your resources up (ie sql hogging all your resources.) This is just a quick starting point, hope this helps

03-16-2004, 09:22 PM	#6
Ash@phpFX Confirmed User Join Date: Nov 2003 Posts: 4,292	my guess would be hotlinking also, do you have protection set up?

03-16-2004, 10:38 PM	#9
HS-Trixxxia Confirmed User Join Date: Mar 2002 Location: Montreal Canada Posts: 2,946	Well if you're able to check your traffic sources, you should be able to see if they are hotlinking or if someone is sending you a tremendous amount of traffic, right? So if all your programs say it's not an increase in traffic - what does your host say it is? __________________ ~~♥~~♥~~♥~~♥~~♥~~♥~~♥~~♥~~ Patrizia COO - ♥ MassiveDollars Email: patrizia at MassiveDollars dot com ICQ: 465.826.441 Yahoo: trixxxia_me MSN: trixxxia at hotmail dot com

03-16-2004, 10:47 PM	#10
jmk Confirmed User Industry Role: Join Date: Sep 2002 Posts: 5,391	Yeah figure it out with your logs and redirect that traffic

03-16-2004, 10:57 PM	#11
KobyBoy Confirmed User Join Date: Jul 2003 Location: Purgatory Posts: 201	Don't know how comfy you are with the command prompt. I assume we are talking about a Linux box so this is going to be a Linux tip. There's a program call IPLog that once you install can monitor your network. It keeps a record of who's accessing your machine and which port/protocol they are using. You might want to give that a try. You can find IPLog here: (http://ojnk.sourceforge.net/)

03-16-2004, 11:00 PM	#12
sumphatpimp Confirmed User Join Date: Aug 2002 Posts: 5,235	they could be sending spam through your server. just hack in and install whatever software is needed and spam away. and you hold the bag for it. nothing but profit for them. you just have to check your logs for unusual activety and see if you have any scrpts you don't recognise, and what are they chmod for, can you get into them? good luck

03-16-2004, 11:20 PM	#14
Fukeneh Confirmed User Industry Role: Join Date: Mar 2004 Location: Location: Location: Posts: 1,245	server got cracked?

03-17-2004, 07:42 PM	#15
debbieN Confirmed User Join Date: Jan 2003 Location: FL, NC(I burned this down), MI Posts: 1,193	thank to all. agian excellent answers. I let you know when I fix this problem. __________________ don't rent the top room at the Luxor ______________________ Debbie Nomad's Evil Hobby