If you ever need to figure out what is eating bandwidth on a server, tcpdump comes in handy…
tcpdump -n -i any
That will spew out everything, so you might be able to find anything that looks suspicious in there. Say you find the IP address of 22.214.171.124 doing something suspicious, you can zero in on them to see if they are doing anything naughty like so:
tcpdump -n -i any host 126.96.36.199
In my case, someone was utilizing one of my DNS servers for about 200 lookups per second (not logging DNS lookups and it’s UDP traffic so it was hard to figure out where the bandwidth was going).
Once you find a naughty IP address, now just block them like so:
route add -host 188.8.131.52 reject (Linux)
route add -host 184.108.40.206 255.255.255.255 -reject (Mac OS X/BSD)