If you ever need to figure out what is eating bandwidth on a server, tcpdump comes in handy…
tcpdump -n -i any
That will spew out everything, so you might be able to find anything that looks suspicious in there. Say you find the IP address of 220.127.116.11 doing something suspicious, you can zero in on them to see if they are doing anything naughty like so:
tcpdump -n -i any host 18.104.22.168
In my case, someone was utilizing one of my DNS servers for about 200 lookups per second (not logging DNS lookups and it’s UDP traffic so it was hard to figure out where the bandwidth was going).
Once you find a naughty IP address, now just block them like so:
route add -host 22.214.171.124 reject (Linux)
route add -host 126.96.36.199 255.255.255.255 -reject (Mac OS X/BSD)