I have a dedicated server with a 100 Mbps port. A few times a week, there comes a time (usually in the evening hours) when there is an extremely high bandwidth usage, by far more than usual.
I am on CentOS 6 with cPanel and host a few dozen websites. I have installed IPTraf to be able to monitor the bandwidth usage in real time. During those evening hours, the lo interface shows about 55 - 90 Mb/s and the eth0 interface about 5 to 20 Mb/s. Which, added together, equals about 70 to 100 Mb/s. This lasts for about 3-4 hours and the server is hardly reachable. After that, the activity drops to something between 100 Kb/s and 2 Mb/s and it stays that way for the majority of hours during the day.
I also have csf installed and I have only allowed certain ports to go through, but in IPTraf's traffic monitor I see a lot of IP addresses with random ports like 51970 or 45398 connecting to the server.
What issue could I be facing here?