Recently I noticed that apache 2 extended status page was reporting about huge (not normal) traffic usage. However when compared with ifconfig stats I can see that:

TX bytes:1819746601 (1735.4 Mb)

where at the same time and for the same work period apache2 extended status reports:

Total accesses: 42019 - Total Traffic: 7.2 GB

Box has 5 IPs and it looks like these weird statistics are being generated only by one IP, that is if I turn off apache listenning on this IP, stats look normal. Also any downloads from this IP look very distorted (constantly stops) like it is heavily loaded, however downloading from the same box but from different IP goes smooth and fast.

Can someone please explain to me why is this happening? Could it be because of hosting provider firewall rules or something else? I am desperate, please help, any advice will be greatly appreciated. Thank you.

Is that ifconfig output the TX amount for just that one IP causing trouble or a total of all IPs?

Are the IP addresses virtual or all on seperate physical adaptors? If it's a seperate physical adaptor, that may be playing up.

It shouldn't be any firewall rules... if you could, please post a list of your setup and hopefully we can find something!

Thank you for your reply Technonotice.

Well, I have been doing my own research yesterday and today. And so far I have absolutely no idea why is this happening. Box is Redhat 7.3 last updated (heh, guess there will be no future updates from redhat) stock kernel (2.4.20-28.7) IPs assigned to virtual interfaces eth0, eth0:1, eth0:2, eth0:3, eth0:4, apache is 2.0.48.

I have checked things again with a nice utility iptraf and it confirmed and showed the same difference in bandwidth utilization. When apache extended status shows there have been about 50 megabytes of transfers made, detailed stats of iptraf for the same period of time show only about 5 or less megabytes.

Tried to put squid to control bandwidth for this IP. Configured it (assigned real IP:80 to squid and redirected httpd_accel_host 127.0.0.1:80 then reconfigured apache) and.... I can see absolutely NO difference. Though, if I block everyone (using iptables) from accessing this IP and permit access only to myself I can see that squid is doing it's job well and bandwidth is really limited exactly to the rate I put. But, as soon as I delete iptables restriction rules everything starts again, i.e. download starts to break and apache shows crazy bandwidth when at the same time iptraf shows ~10 times lower traffic usage.

I have just scanned system for viruses and trojans with f-prot and it found nothing, will run chkrootkit additionally, but don't think it will find anything either.

Please, if anyone have any idea why do such things happen, please reply. I am really desperate, don't know what else to do...

Just an idea... in iptraf you're selecting the appropriate interface that the IP is coming through - you didn't mention which of the interfaces the problem lies on but I assume it's one of the virtual ones (eth0:x). What do you measure in iptraf if you select the loopback interface (lo)?

I also assume that you're working remotely and not viewing the website (via squid) on localhost via lynx or something. So when you blocked using iptables you would have closed off all IPs, including localhost except your remote one. It's quite possible you've got a service/program running on the system itself which is generating the activity... still shouldn't be causing that much of a problem on Apache though.

On all systems of course there will be localhost traffic that is busy doing other things (local MySQL server perhaps) but you should notice it.

Alternatively, is that VirtualHost in Apache set up as the default, "if all else fails" host? If so there could be something connecting to Apache but looking for a different site...

I can't think of anything else off the top of my head though.