eating bandwidth!

hi
my data center shows me a report that shown my ip is downloading many gigs in a day!
in directadmin , there is no data for that.

how can i found what user eating server bandwidth?

in "show all users" , bandwidth column , everything seems to be ok.

and directadmin says , we not calculate script download/upload in user bandwidth.


help me plz.

If it does not show anywhere in DA, it might be something else like zombie's or malware or something.
In any case it's best to monitor the traffic for some time and see what's eating the bandwidth, check this page:
http://www.binarytides.com/linux-commands-monitor-network/

tanks for your reply.
but , all of this services is real time monitor, and i can't stay 24 hours on monitor and see who using bandwidth !!!
is there a way , to show me what ip/port/program/... using bandwith in past 24 hours? and how many use ?

tanks.

If directadmin did not log all those amounts of traffic you need to use 3rd party tools to monitor it. Depending on tools you are going to use you can monitor traffic per port or even per user and see history of usage. Directadmin does not offer anything of the kind. So here you are mostly on your own.

I'd rather start from analyzing of stats from your DC, and see at what time you have the most traffic usage, then I'd try to compare it with activity patterns from your server by search details from logs. Please note, directadmin by default keeps limited number of logs, so the history of logs is limited with 5 days retention only.

Meanwhile I'd run a malware scanner and try to find malicious activity on the server; upgrade all the binaries and packages; install a firewall to avoid traffic leakage, misc.