I have a web server on a coloc host. All 'planned' activity is over HTTP. (There's no FTP server, no bittorrent client, no IRC bots, etc.)
My inbound traffic is consistently 5-10 times higher than my outbound traffic. (For example, over the past 24 hours I have served 228MB of data, but received 1.94GB.)
Is this standard/expected for a web server? (Am I perhaps getting slammed with thwarted nefarious attempts whose packet size versus a 0-byte response overwhelms the normal inverse relationship?)
If this is not expected, what tools should I use to investigate where the traffic is coming from? (The server is running Ubuntu 10.04.)
ifconfig
showsRX bytes:9.3GB TX bytes:1.4GB
on the ethernet interface. Further, I've performed multiple tests where I download massive amounts of data from the server over a short period of time and see the "outbound" graphs spike, confirming which direction is which. It seems pretty clear to me that it is data flowing into my server that is outpacing the data flowing out of it.