Urgent! How to check the incoming and outgoing bandwidth! Please help

We have installed few servers in data center. These servers are DNS
servers, mail servers and web servers. Everything was fine for few years.
But I received a warning from data center today and said that the overseas
bandwidth has reached 6Mps in these few months which is exceeding of our
entitled bandwidth level. They are asking for a lot of money for the
overuse bandwidth. It is crazy. The additional cost is 5 times more than
the normal subscription fee.

I am wondering if our servers are being hacked or there may be some
abnormality at our servers. I would like to know how can we checked the
following data:

1) The income and outgoing bandwidth of each server
2) The bandwidth usage for overseas
3) Which IP uses the most bandwidth
4) Which application in the server uses the most bandwidth
5) What Port uses the most bandwidth

Is there any software or method that can provide me more data to find out
what the problem is or how to solve it?

Please kindly advise us how to figure out the problem and solve this
problem. Our data center has given us the deadline to solve it in 5 days.

Please Please Please.

Chris

Enable netflow and/or nbar on your routers.

"Chris" <(E-Mail Removed)> wrote in message
news:OrP6D$(E-Mail Removed)...
> We have installed few servers in data center. These servers are DNS
> servers, mail servers and web servers. Everything was fine for few years.
> But I received a warning from data center today and said that the
overseas
> bandwidth has reached 6Mps in these few months which is exceeding of our
> entitled bandwidth level. They are asking for a lot of money for the
> overuse bandwidth. It is crazy. The additional cost is 5 times more than
> the normal subscription fee.
>
> I am wondering if our servers are being hacked or there may be some
> abnormality at our servers. I would like to know how can we checked the
> following data:
>
> 1) The income and outgoing bandwidth of each server
> 2) The bandwidth usage for overseas
> 3) Which IP uses the most bandwidth
> 4) Which application in the server uses the most bandwidth
> 5) What Port uses the most bandwidth
>
> Is there any software or method that can provide me more data to find out
> what the problem is or how to solve it?
>
> Please kindly advise us how to figure out the problem and solve this
> problem. Our data center has given us the deadline to solve it in 5 days.
>
> Please Please Please.
>
> Chris
>
>
>
>

We don't have our own router. The Data Center provides us four Ethernet
Ports. We just direct plug the ethernet ports to the servers.

So how can I figure out the problem?


"Neteng" <(E-Mail Removed)> ¼¶¼g©ó¶l¥ó·s»D:OMPH$(E-Mail Removed) bl...
> Enable netflow and/or nbar on your routers.
>
> "Chris" <(E-Mail Removed)> wrote in message
> news:OrP6D$(E-Mail Removed)...
>> We have installed few servers in data center. These servers are DNS
>> servers, mail servers and web servers. Everything was fine for few
>> years.
>> But I received a warning from data center today and said that the
> overseas
>> bandwidth has reached 6Mps in these few months which is exceeding of our
>> entitled bandwidth level. They are asking for a lot of money for the
>> overuse bandwidth. It is crazy. The additional cost is 5 times more
>> than
>> the normal subscription fee.
>>
>> I am wondering if our servers are being hacked or there may be some
>> abnormality at our servers. I would like to know how can we checked the
>> following data:
>>
>> 1) The income and outgoing bandwidth of each server
>> 2) The bandwidth usage for overseas
>> 3) Which IP uses the most bandwidth
>> 4) Which application in the server uses the most bandwidth
>> 5) What Port uses the most bandwidth
>>
>> Is there any software or method that can provide me more data to find out
>> what the problem is or how to solve it?
>>
>> Please kindly advise us how to figure out the problem and solve this
>> problem. Our data center has given us the deadline to solve it in 5
>> days.
>>
>> Please Please Please.
>>
>> Chris
>>
>>
>>
>>
>
>

Next best thing is a sniffer (www.wireshark.org)

"Chris" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> We don't have our own router. The Data Center provides us four Ethernet
> Ports. We just direct plug the ethernet ports to the servers.
>
> So how can I figure out the problem?
>
>
> "Neteng" <(E-Mail Removed)>
¼¶¼g©ó¶l¥ó·s»D:OMPH$(E-Mail Removed) bl...
> > Enable netflow and/or nbar on your routers.
> >
> > "Chris" <(E-Mail Removed)> wrote in message
> > news:OrP6D$(E-Mail Removed)...
> >> We have installed few servers in data center. These servers are DNS
> >> servers, mail servers and web servers. Everything was fine for few
> >> years.
> >> But I received a warning from data center today and said that the
> > overseas
> >> bandwidth has reached 6Mps in these few months which is exceeding of
our
> >> entitled bandwidth level. They are asking for a lot of money for the
> >> overuse bandwidth. It is crazy. The additional cost is 5 times more
> >> than
> >> the normal subscription fee.
> >>
> >> I am wondering if our servers are being hacked or there may be some
> >> abnormality at our servers. I would like to know how can we checked
the
> >> following data:
> >>
> >> 1) The income and outgoing bandwidth of each server
> >> 2) The bandwidth usage for overseas
> >> 3) Which IP uses the most bandwidth
> >> 4) Which application in the server uses the most bandwidth
> >> 5) What Port uses the most bandwidth
> >>
> >> Is there any software or method that can provide me more data to find
out
> >> what the problem is or how to solve it?
> >>
> >> Please kindly advise us how to figure out the problem and solve this
> >> problem. Our data center has given us the deadline to solve it in 5
> >> days.
> >>
> >> Please Please Please.
> >>
> >> Chris
> >>
> >>
> >>
> >>
> >
> >
>
>

"Chris" <(E-Mail Removed)> wrote in message
news:OrP6D$(E-Mail Removed)...
> We have installed few servers in data center. These servers are DNS
> servers, mail servers and web servers. Everything was fine for few years.
> But I received a warning from data center today and said that the
> overseas
> bandwidth has reached 6Mps in these few months which is exceeding of our
> entitled bandwidth level. They are asking for a lot of money for the
> overuse bandwidth. It is crazy. The additional cost is 5 times more than
> the normal subscription fee.
>
> I am wondering if our servers are being hacked or there may be some
> abnormality at our servers. I would like to know how can we checked the
> following data:
>
> 1) The income and outgoing bandwidth of each server
> 2) The bandwidth usage for overseas
> 3) Which IP uses the most bandwidth
> 4) Which application in the server uses the most bandwidth
> 5) What Port uses the most bandwidth
>
> Is there any software or method that can provide me more data to find out
> what the problem is or how to solve it?
>
> Please kindly advise us how to figure out the problem and solve this
> problem. Our data center has given us the deadline to solve it in 5 days.
>
> Please Please Please.
>
> Chris
>

Hi Chris,

You could try installing bandwidth monitoring software on all the servers to
isolate the one(s) that are using high bandwidth. Various tools exist for
both windows and linux - google lists most of them.

steve

A couple options:
Perfmon
ntop

"Chris" <(E-Mail Removed)> wrote in message
news:OrP6D$(E-Mail Removed)...
> We have installed few servers in data center. These servers are DNS
> servers, mail servers and web servers. Everything was fine for few years.
> But I received a warning from data center today and said that the overseas
> bandwidth has reached 6Mps in these few months which is exceeding of our
> entitled bandwidth level. They are asking for a lot of money for the
> overuse bandwidth. It is crazy. The additional cost is 5 times more than
> the normal subscription fee.
>
> I am wondering if our servers are being hacked or there may be some
> abnormality at our servers. I would like to know how can we checked the
> following data:
>
> 1) The income and outgoing bandwidth of each server
> 2) The bandwidth usage for overseas
> 3) Which IP uses the most bandwidth
> 4) Which application in the server uses the most bandwidth
> 5) What Port uses the most bandwidth
>
> Is there any software or method that can provide me more data to find out
> what the problem is or how to solve it?
>
> Please kindly advise us how to figure out the problem and solve this
> problem. Our data center has given us the deadline to solve it in 5 days.
>
> Please Please Please.
>
> Chris
>
>
>
>