My cpanel install shows bandwidth usage at around 250MB.

Bandmin and Orbit monitoring shows 10GB (way more than normal for this server).

Strange thing is my ns2.nameserver IP address is showing about half the traffic in bandmin (5GB). It normally shows almost nothing. Seems to start around 2AM (500MB per hour) and end around 6AM. Everything is normal until 1-2AM.

Any ideas on where to start? Looked through every log and found nothing odd.

Thanks,
John Phillips

Check the server logs. Cpanel Bandwidth monitoring merely shows traffic generated by services which Cpanel manages and it does not include all the servers. The Orbit Bandwidth Monitoring is more accurate as it tracks all traffic going in and out of your port.

If there is a huge difference, there is two possibility, one is that the Cpanel Bandwidth Monitoring has stopped working/broken or that there are some hidden services which are running which you are unaware of (this includes non-cpanel tracking daemons, some runaway services or some trojan). The specific timing may mean that the services which generates the most traffic may be controlled by a cron job. Find out what services are activated at the time in crontab.

In situation such as this, checking all your system logs may be a prudent step and also to do a Vulnerability Scanning of the server in question.

Make sure that the server is all patched up and that all vulnerability points are locked.

Thanks for the input...

This is really strange. Went through every log with a fine tooth.... Nothing out of place. Checked firewall and ports... fine. Load on server very low as always. Nothing in crontab. /tmp dir clean. I'm a patch fanatic so everything is up-to-date. I'm having a vulnerability scan now (been going 12 hours)

Only strange thing I've noticed is two "named" processes using the most cpu/mem at any given time and running for 1-20 min. at a time. One just hit 30min. Not sure if this is normal. They both live at the top of my "top".