Finding network traffic sources.
 

Hi!

Last month we where charegd for 800 GByte network traffic for one our web servers.

The last two month the sever has had much higher net traffic then whats normal and now I want to detect and eliminate the source of this.

I can't find any signs of the server being hacked but something is very very wrong ...

Any tips on how to proceed .. awstats showed normal (=low) traffic to/from the web server.

Thanks in advance!

I would have a look to /var/log/apache2/access.log. If you are not running apache log, then of course have a look to your web access log. You will probably find something interesting.