If you ever need to figure out what is eating bandwidth on a server, tcpdump comes in handy…
tcpdump -n -i any
That will spew out everything, so you might be able to find anything that looks suspicious in there. Say you find the IP address of 188.8.131.52 doing something suspicious, you can zero in on them to see if they are doing anything naughty like so:
tcpdump -n -i any host 184.108.40.206
In my case, someone was utilizing one of my DNS servers for about 200 lookups per second (not logging DNS lookups and it’s UDP traffic so it was hard to figure out where the bandwidth was going).
Once you find a naughty IP address, now just block them like so:
route add -host 220.127.116.11 reject (Linux)
route add -host 18.104.22.168 255.255.255.255 -reject (Mac OS X/BSD)