How to relate bandwidth spikes to IP addresses

[abstractspoon]

Hi All


Is there a specific way I can identify the IP address(es) responsible for these spikes ?

I know I can 'look at the logs', but I was hoping someone might have worked out a more specific methodology to use...

 

[cPRex]

Hey there! Do you have root access to the server, or just access to the one cPanel account in question? Although the lines aren't on the hour, it does look to be hourly, which could be caused by a cron, if this traffic is showing outbound data.

If this is inbound data, you'll want to check the cPanel >> Raw Access Logs chart and review those logs to see if you can identify any patterns there. I know that is just "checking the logs" but unfortunately there isn't going to be an easier solution available.

 

[abstractspoon]

Hey there! Do you have root access to the server, or just access to the one cPanel account in question? Although the lines aren't on the hour, it does look to be hourly, which could be caused by a cron, if this traffic is showing outbound data.

If this is inbound data, you'll want to check the cPanel >> Raw Access Logs chart and review those logs to see if you can identify any patterns there. I know that is just "checking the logs" but unfortunately there isn't going to be an easier solution available.

Many thx cPRex

The possibility of it being caused by a cron job did not occur to me (bit of a noob) so that's definitely helpful. I'm on a shared server so I'll have to contact my hosting service but at at least I've got a bit more to go on and I can target my log viewing.

 

[Rachel S]

If reviewing the logs is not working for you, there are some other methods you can try in cPanel to identify the IP address responsible for the bandwidth spikes:

Use the "Bandwidth" section in cPanel to identify which files or directories use the most bandwidth. If you can pinpoint a specific file or directory that is responsible for the spike, you can use the "Latest Visitors" feature to see which IP addresses have accessed that file or directory.

Go to "Raw Access" in cPanel and look for the IPs that have accessed your website during the time of the bandwidth spike.

If you have Cloudflare or a similar CDN service enabled. In that case, you can check the analytics provided by the service to see if there is any CDN service.

 

[abstractspoon]

Thx Rachel, I have enabled CloudFlare, so I'll give them a try too.