Traiffic Monitoring

[jdcooke]

I recently had a customer who failing to keep his e107 site upto date got hacked.

There was a script which on demand used fopen to send lots of traffic to remote servers.

It took me a long time to track this down as the traffic was not recorded against the specific user despite the fact that it originated from their web page. It was sent out from port 80 as UDP packets to the remote server.

Is there any way for monitoring this outbound traffic as it got recorded as other out but as the server ip rather than as a particular user?

[patrick.geschke]

Maybe ntop is what you should look at.

[kilburn]

The http traffic counting is based on the webserver's logs, not on any network-monitoring thing. As a consequence, all the traffic that is generated by dynamic websites using sockets will *not* be accounted to the user, ever.

[diamondzul]

Network Traffic Monitor is a network analytic tool that examines local area network usage and provides a display of upload and download statistics.