我被警告说我的服务器打破了它的传输限制。 我想我的Tor节点变得stream行起来，所以我select在这个月禁用它（不是社区的最佳select，但我需要下去）。 然后我注意到服务器今天晚上转移了大约4GB。 我已经用Awstats检查了Apache日志，没有相关的stream量（并且我没有在那里提供这么受欢迎的网站）。 我已经检查邮件日志，没有人试图发送垃圾。 我已经检查messages日志，发现吨这些
Apr 29 10:17:53 marcus sshd[9281]: Did not receive identification string from 85.170.189.156 Apr 29 10:18:07 marcus sshd[9283]: Did not receive identification string from 86.208.123.132 Apr 29 10:18:24 marcus sshd[9298]: Did not receive identification string from 85.170.189.156 Apr 29 10:18:39 marcus sshd[9303]: Did not receive identification string from 86.208.123.132 Apr 29 10:18:56 marcus sshd[9306]: Did not receive identification string from 85.170.189.156 Apr 29 10:19:11 marcus sshd[9309]: Did not receive identification string from 86.208.123.132 Apr 29 10:19:18 marcus sshd[9312]: Did not receive identification string from 101.98.178.92 Apr 29 10:19:27 marcus sshd[9314]: Did not receive identification string from 85.170.189.156 Apr 29 10:19:41 marcus sshd[9317]: Did not receive identification string from 86.208.123.132 Apr 29 10:20:01 marcus sshd[9321]: Did not receive identification string from 85.170.189.156 Apr 29 10:20:13 marcus sshd[9324]: Did not receive identification string from 86.208.123.132 Apr 29 10:20:32 marcus sshd[9327]: Did not receive identification string from 85.170.189.156 Apr 29 10:20:48 marcus sshd[9331]: Did not receive identification string from 86.208.123.132 Apr 29 10:21:07 marcus sshd[9336]: Did not receive identification string from 85.170.189.156 Apr 29 10:21:20 marcus sshd[9338]: Did not receive identification string from 86.208.123.132 Apr 29 10:21:35 marcus sshd[9341]: Did not receive identification string from 85.170.189.156 Apr 29 10:21:51 marcus sshd[9344]: Did not receive identification string from 86.208.123.132 Apr 29 10:22:06 marcus sshd[9349]: Did not receive identification string from 85.170.189.156 Apr 29 10:22:23 marcus sshd[9353]: Did not receive identification string from 86.208.123.132 Apr 29 10:22:39 marcus sshd[9359]: Did not receive identification string from 85.170.189.156 Apr 29 10:22:54 marcus sshd[9361]: Did not receive identification string from 86.208.123.132 Apr 29 10:23:10 marcus sshd[9367]: Did not receive identification string from 85.170.189.156 Apr 29 10:23:29 marcus sshd[9369]: Did not receive identification string from 86.208.123.132 Apr 29 10:23:45 marcus sshd[9375]: Did not receive identification string from 85.170.189.156 Apr 29 10:24:10 marcus sshd[9387]: Did not receive identification string from 86.208.123.132 Apr 29 10:24:16 marcus sshd[9388]: Did not receive identification string from 85.170.189.156
每隔几秒钟一个僵尸程序试图破解我的SSH，这是不可能的，因为我需要公钥authentication。 我的问题是：在这个频率上，这个stream量在10个小时的连续攻击中能消耗4GB（比方说3.5）吗？
我已经改变了我的SSH端口，并停止了这些攻击，但我不确定我的networking消耗。 我没有服务失控运行 – 我的防火墙是有点限制，或与滥用P2P或任何其他人共享服务器。 我担心的是低于400GB /月。
任何提示？
4 GB是可能的，但考虑到攻击速度的可能性不大。 我build议安装OSSEC，它会检测到中断尝试，并在一定的时间内自动阻止IP。
如果这些是带宽使用的原因，那么在系统上处理它们时，带宽已经被消耗。 你可以使用像iptraf这样的工具给你分解每个接口/端口上发生的事情，然后你可以根据事实采取适当的行动。
不，这些每秒一次的连接尝试本身在十个小时内不会达到4GB。 你认为你可以在10个小时内下载一个4GB的文件，每秒获得一个小包吗？ 一小时内有3600秒，所以如果你在一个小时内得到一个千字节，那将是36000 Kb，或36兆字节。
你的带宽是根据从你的提供商到你的外部路由器的pipe道来衡量的，而不是到达你的服务器的。 你必须看看没有到达你的服务器的废话，大多数外部设备是拒绝。
至于到达你的服务器的东西，你不能依靠应用程序日志。 即使是由本地防火墙默默丢弃的数据包也是带宽。 接口统计信息（由ifconfig ）会告诉你Tx / Rx字节。