Bandwidth Usage Question:

[sde]

I run Game Servers, and when they are being used most of the day, I end up using about 5GB of bandwidth/day.

We recently reached our limit for the month, so I turned off the Game Servers but continued to keep the HTTPD service on. ( there's only 1 very small site on the server to show player stats )

Even though we stopped the game servers we were still using from 3-5GB per day for 3 days following.

The administrator at the Data Center emailed me this explanation:

The reason you see an increase in usage is because people still tried to
contact your machine while you were offline thus using bandwidth. Your
machine didn't send any requests back, but nevertheless people sent data
to our network through the router which watches traffic and into the LAN
to your machine.

does this seem like a valid response? can i be using just about the same amount of bandwidth i use when the server is full of gamers , as i do just when those gamers are trying to connect?

That could be possible but not likely, generally in a game you would send thousands of packets a minute if not more! All you were getting were constant SYNs, I highly doubt that because you only got a couple packets from every person instead of thousands but it could be a DoS or that new SQL worm hitting you, not only your gamers try to access your server, your probably get around 3 hits a day from NIMDA and god knows how many from the SQL worm as well as kiddie scans, but that's just impossible.




EDIT: A ratio of around 3 packets to 100,000 packets != the ratio of 5 to 3-5

[sdeming]

This is not a good explanation. I would ask for MRTG graphs that demonstrate the traffic coming into your port on their switch.

Basically, if you shut the game services down then they are not responding to the requests and your traffic will illustrate this. Your inbound traffic may still be greater than 0 but your outbound should be near 0. Even so, your inbound traffic will fall dramatically since no connection is maintained and the typical resulting conversation between client and server does not happen.

Bottom line, if you typically pushed/pulled near 5 GB per day and are still pushing/pulling nearly the same amount after shutting down the game then something else is happening. What you may want to do is run tcpdump and get a capture of the raw data coming in/going out. I am willing to bet that you will not see that much. Force your provider to give you access to the MRTG graphs for your port. It isn't enough to take their word for it, they have to be able to back up their claim. If possible, ask your provider access to the SNMP community (read only access should be provided without any concern) on the switch pull the data yourself.

[sde]

thanks a lot,

he did offer to have reports emailed to me.. so i took him up on the offer. dont' know what i'm looking for exactly, but hopefully it will shed some light on the matter.