HI All,

Can anyone make any suggestions on what could cause this kind of usage over three days.

date sum in out
2006-04-01 1461.86 233.53 1228.33
2006-04-02 1774.30 279.79 1494.51
2006-04-03 1857.10 256.43 1600.67
2006-04-04 95375.82 86740.21 8635.61
2006-04-05 27081.89 23605.58 3476.32
2006-04-06 66551.37 59083.78 7467.59
2006-04-07 2191.30 336.44 1854.87
2006-04-08 3258.31 313.95 2944.36

Hi mark,

I am unable to grok those numbers at all, I'm assuming they are large and/or your not sure who or what is causing it.

ssh to your box. You will probably need to be root to do this.
Use netstat -antu to show current connections. Look for anything weird.

Use tcpdump to investigate traffic between two hosts.
tcpdump -i eth0 src 192.168.0.6
tcpdump -i eth0 dst port 53

for example, all traffic between two hosts and all dns traffic to your box.

install ntop. this web-based package will give you a complete run down of all traffic on your system.

da!!as