Puzzle! webmaster try to solve this.
 

my bandwidth usage has increase for one of my servers by 250% per day over the last 18 days.

all my tracking services have not shown more than an increase of 10% of all unique hits (TGPs, SE, Toplists, Directories). So none of the normal traffic has produced this dramatic increase.

Also, this was not a gradual build up it was an instant spike that has not changed.

So far easyservermanagement has not found the problem.

They say that no one has penetrated the server's firewall or anti-hacking protocals.

Unforturately I am not server savey and do not know how to access my ftp log files to figure this out.

any thoughts.

:helpme

someone hot linking some movies or something maybe?

umm go to yourdomain.com/stats or /webalizer and then check your logs

login using an ssh program like putty (its free, search for it) right after you login type 'top' (without the quotes) this will show your cpu load and what programs are using what resources etc. There will be some numbers across the top, this is your cpu load, if any of them are over 10 or so you might have some issues. Also look for anything strange that might be using your resources up (ie sql hogging all your resources.) This is just a quick starting point, hope this helps :)

I do not have movies, which would make sense if I did.

They would have had to hotlink thousands of pics and generate 2.5 times the amount of traffic I usually get per day.

One dramatic spike and I has not gone down yet.

I had webalizer installed but it was removed after the last hacker attack. I will get this reinstalled wednesday.

Other than easyservermanagment who do you use that can find these things out?

my guess would be hotlinking also, do you have protection set up?

hot linking would be difficult for such a large amount of bandwidth increase - unless they are using it for TGPs.

I never thought that someone would use my TGP posts to resubmit to TGPs. That might be possible.

that might be the problem.

since all my tgp galleries are permanent they are out there for hotlinking.

damn.

Might be worthwhile putting some protection in place to prevent this

Well if you're able to check your traffic sources, you should be able to see if they are hotlinking or if someone is sending you a tremendous amount of traffic, right? So if all your programs say it's not an increase in traffic - what does your host say it is?

Yeah figure it out with your logs
and redirect that traffic :)

Don't know how comfy you are with the command prompt. I assume we are talking about a Linux box so this is going to be a Linux tip. There's a program call IPLog that once you install can monitor your network. It keeps a record of who's accessing your machine and which port/protocol they are using. You might want to give that a try. You can find IPLog here: (http://ojnk.sourceforge.net/)

they could be sending spam through your server.

just hack in and install whatever software is needed and spam away.

and you hold the bag for it.


nothing but profit for them.

you just have to check your logs for unusual activety and see if you have any scrpts you don't recognise, and what are they chmod for, can you get into them?


good luck

Could be any number of things tho if I were you i'd be installing a package to
record what kind of data you server is seeing ( something like net-acct for
Linux servers ).

That way you can tell your utilization isn't bullshit ( i wouldn't always trust
your hosting provider :2 cents: ) and you can idenfity what the traffic is.

- Az

server got cracked?

thank to all.

agian excellent answers.

I let you know when I fix this problem.