I'm having some trouble understanding the output of Ntop.
I'm receiving high bandwidth warnings for one my (debian) servers from my network provider. Because the server runs only a few low traffic sites, and I couldn't find anything being too busy, I have installed NTOP.
In Ntop I can see there is some weird traffic going on but it is hard too understand.
On trafficStats -> application protocols, I have a high 10gb of Mail_POP traffic. I don't use POP on the server though. Only HTTPS/HTTP and SSH are open.
On trafficStats -> eth0 report, I find this 10gb under "non-ip traffic", with only 1gb ip traffic.
On hosts -> traffic, Only the server itself has a little traffic 1.5 gb but the 10gb Mail_POP traffic does not show anywhere.
Ntop uptime is 6 days but the server itself is first seen yesterday.
Can anyone help to understand these readings? What is Mail_POP What could be causing the high traffic spikes? Do I need to provide more information?