I have the website on Amazon EC2 instance on centos.

I have seen that so much stuff has been downloaded from amazon Network out graph 300GB.

at that time i turned off apache

When i type ifconfig then i can also see the Tx bytes there.

But even though i turned off apache , i could still see apache process runnning with top command

and my data in ifconfig was still increasing.

Is there any way to find out which files were being downloaded and from where

closed as off-topic by Magellan, Iain, Dan, Falcon Momot, Jenny D Sep 5 '13 at 13:55

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – Magellan, Iain, Dan, Falcon Momot
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Run ntop and find out. – Nathan C Sep 5 '13 at 1:17
  • @NathanC where is ntop located , is it automatically installed or i have to install it. – user22 Sep 5 '13 at 1:28
  • You have to install it yourself. – Nathan C Sep 5 '13 at 1:29
  • @NathanC i have htop installed. do i need ntop or htop will do – user22 Sep 5 '13 at 1:38
  • @NathanC , i have installed ntop, how to use it – user22 Sep 5 '13 at 2:39

The answer is dependent on your logging configuration and verbosity.

By default on CentOS, Apache installed using the base yum repos without modification post-install is going to be in /var/log/httpd/access_log

Not sure what the default format is, but I believe it will include all HTTP requests, so search for requests for files first (i.e. any path ending in something like .jpg .mp3 .pdf or whatever files you have)

  • I ahve many files in access log like pdf. but i am not sure which files are genuine and which are done by hacker – user22 Sep 5 '13 at 1:28
  • Are you saying the hacker is requesting files that don't exist? Check the status code of the response, if it succeeded the file exists and was transferred. – inetplumber Sep 5 '13 at 1:35
  • no i am not sure which files hacker downloaded , because in access_log its not that many , they all look genuine. Is there any other way for hacker to download files. because i remeber when i turned off teh apache even then data was being transmitted any very high rate – user22 Sep 5 '13 at 1:38
  • yes. HTTP is only one of many protocols that allow for file transfer, SSH and FTP are going to be two other common ones. you can use lsof to see what files processes currently have open. – inetplumber Sep 5 '13 at 1:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.