Different monitored stats from Web trends

[musicales]

My host is claiming their bandwidth monitor shows 300GB per month of transfer whereas webtrends shows only 60GB - I have ruled out email and ftp being behing the difference and have all other ports shut down. Can anyone suggest any reasons for this, and any tools I could use to monitor the problem on the (Windows 2000) server.
I've used AnalogX but it seems to be unreliable for this.
Thanks very much for any input.

[sagerock]

How have you ruled out email? There is a possibility, if your host allows email relaying, that someone else is using your account to send relayed email.
The only reason I bring it up is because it once happened to me.

[musicales]

the volume going through my email server was low - but do you know if it would show up if coming from elsewhere. I confess, email relaying one technical mystery to me!

[sagerock]

It should technically show up on the email server, especially if it's smtp - something like Imail. But I will say that spammers are quite industrious. Oh...! is there a possibility that there is an anonymous access hole somewhere on your site? Windows has been known to leave things like that open.
I've seen warez guys upload files to really deep, hidden directories and then distribute their stuff from there. This could potentially be in an ftp directory.

[pageoneresults]

> webtrends shows only 60GB.

Which version of WebTrends are you using. Have you excluded any IP's from the logging? If so, that would probably make up some of the difference. I'm using both the server based WebTrends and WebTrends Live to track statistics. My server based statistics are always much higher than the Live version. This is because I've excluded certain IP's from distorting my stats.

<edit>I would tend to lean more towards what sagerock is describing. We've had this problem in the past using imail.</edit>

[edited by: pageoneresults at 9:32 pm (utc) on Nov. 12, 2002]

[musicales]

sagerock - do you know how I could trace something like that? I do have a few pages where people can upload text files, so that might be a possiblity
Thanks for your help.
- pageoneresults - version 3.5 I don't think I'm exluding any IPs at all.

[sagerock]

A lot of that depends on what monitoring your host has set up. If you feel quite strongly that you haven't used 300GB of transfer I would send these thoughts to your host. Also, if you don't normally use that much bandwidth per month then there should be a red flag.
I've seen first hand that Windows is a great place for email relay and warez distribution.
Otherwise, they should be able to tell you where all that bandwidth came from.
I hope this helps.

[musicales]

I've told the host and while they're willing to help they keep saying that's what their monitor shows. I've had the site on other hosts and the stats always said 50=60GB so I'm fairly confident I'm right. Do you know of any tools I could install on the server to check bandwidth? I've found some that do 'current transfers' but none that display how much, say this hour.
Thanks again

[sagerock]

Thanks for this discussion musicales. After being a member since July 2000, I'm proud to say I'm finally a full member. Thank goodness!
I don't know of any remote tools off hand. You might try cgi-resources.com. They may have something. Even if you find something it's going to be their word against yours. I think all you probably can do is state your case, tell them your past history, and offer some suggestions - such as the things we discussed.
I would imagine they probably want to charge you a pretty hefty fee for the extra bandwidth.
Do you have any records of hits, page views, and visitors you've gotten in past months? Maybe showing them those comparisons to this past month might sway them.
But they probably aren't going to spend too much time investigating this. If it happens another month you might want to shop around.

[musicales]

well done! I think its' 80 posts for full member right?! That means I've another 20 or so to go! Thanks for your suggestions anyway.

[sagerock]

Best of luck to you!
Let us know how it all turns out.