This doesn't add up / have I been rooted?

From: rw (
Date: 09/25/03

Date: Thu, 25 Sep 2003 05:26:35 GMT

My ISP hit me with an extra charge as I've exceeded my 1 Mbps bandwidth
monthly average. I run a webserver with a linux lvs and 8 freebsd
'realservers' running Apache being directed by the LVS. I recently
installed ntop on a machine located on a hub along with the linux lvs
machine and have validated that I am, in fact, running close to 2 Mbps
depending on the time of day and day of the week. Ntop is telling me
that >99 percent of this traffic is http which makes sense as that's all
these machines are supposed to be doing.

I have two stats packages that analyze the daily Apache logs and both of
them tell me that I'm transferring about 150 gigabytes/month. When I
do the math that comes to about 0.46 Mbs. Where are the other 1.5 Mbs
coming from?

Is it possible that I've been rooted and 'something' is running that is
transferring that much data and I can't see it? I run ads from an
external ad server which I don't measure but, as I understand it, the
bandwidth for those images should not be part of my bandwidth.

I'm baffled.

Here's my math:

1Mbs = 1/8 MBs

.125 megabytes/second * 60 seconds/minute * 60 minutes/hour * 24
hours/day * 30 days/month = 324,000 megabytes/month or 324

Am I missing something?