hacked?

conflicting traffic reports

[wheel]

I'm curious if anyone knows of hacks that use port 80 for traffic on a linux system.

I've got a server where webalizer, and history indicate that I'm burning 1 gig per day. My router on the other hand, is showing 2 gigs a day (as is my upstream ISP). So I'm using 2 gigs, but the machine is only showing 1 gig.

The server only hosts one domain (a community forum). The router is showing all traffic (the full 2 gigs) as coming and going on port 80. That strikes me as odd,since I would have thought they'd be hacking and using traffic on some other port, like email or something. And if it's on port 80, webalizer should be seeing it - and it should be coming from the one domain on the server. I'm admittedly confused.

My tech is working on it, in the meantime, has anyone experienced anything like this?

[ncw164x]

I've got a server where webalizer, and history indicate that I'm burning 1 gig per day

Have you took into consideration your daily backup's and any FTP to the server, or anything else which is ran from your server, all these thing do not show in a sites log file they are on top of any traffic movement.

just a thought :)

ncw164x