I recently set-up a dedicated server at an isp.

Immediately, the isp began billing me for 20gb of traffic a day.

The only services availible for the outside are ssh and tomcat.

The tomcat logs are almost empty.

Netstat -an reveals no suspicous connections or activity.

IP Accounting with iptables reveals minimal activity on the filter table.

There seems to be some significant activity on the mangle table prerouting chain.

There are no mangle rules specified.

What might this indicate? How can I dig further?


Thanks for any help...

Welcome to LQ.

The first thing I'd do is run "ifconfig" and see what the tx and rx bytes are. This will easily let you see how much traffic is flowing over the interfaces, it's possible that the ISP is mistaken.

Using ethereal will give you a decent overview of what traffic is flowing at any one time.

Damn those ISPs are all the same. Report them to some cunsumer association.