up vote 0 down vote favorite
share [g+] share [fb]

I am not sure if this is the correct forum to be posting to, but I thought someone might be able to help?

I have a client running Zen Garden on their site which was phished not too long ago. Ever since then, his bandwidth usage on the site has hit the roof and I was wondering if anyone know of a solution to this please?

Thanks!

link|improve this question
20% accept rate
1  
This is not a forum but a QA site and your question is too much vague – radius Jun 28 '10 at 22:29
It's not clear what you are asking. Maybe reword your question to say something like 'How do I measure the bandwidth on my site? I am using the operating system 'X' and the webserver 'foo', if that's what you want to know. – Stefan Lasiewski Jun 29 '10 at 0:32
feedback

3 Answers

up vote 1 down vote

If the site was compromised, nuke the server and start again. See also:

http://serverfault.com/questions/6159/aftermath-of-hack

http://serverfault.com/questions/tagged/intrusion-cleanup

link|improve this answer
Also, remember to add in any security patches/processes that are needed to prevent the same thing happening again. – DrStalker Jun 29 '10 at 1:22
feedback
up vote 1 down vote
  1. If you determine you've been hacked, take your webserver off the network please. Your server may be serving malware, spamming people, functioning as part of a botnet and serving bad stuff for the bad guys.

If you are using Apache webserver, take a look at some of the other Log modules provided by Apache. These can help you track down if your webserver is doing anything strange. These two sound relevant:

Logging actual bytes sent and received

mod_logio adds in two additional LogFormat fields (%I and %O) that log the actual number of bytes received and sent on the network.

Forensic Logging

mod_log_forensic provides for forensic logging of client requests. Logging is done before and after processing a request, so the forensic log contains two log lines for each request. The forensic logger is very strict with no customizations. It can be an invaluable debugging and security tool.

link|improve this answer
feedback
up vote 1 down vote

If you have access to an upstream router look at the traffic that is making up the bandwidth; it could be anything from an open proxy to file sharing site full of illegal content.

link|improve this answer
Or run tcpdmp, set up SNMP monitoring from another host (using eg. Cacti), etc. – Andrew Jun 29 '10 at 1:45
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.