I have a web server on a coloc host. All 'planned' activity is over HTTP. (There's no FTP server, no bittorrent client, no IRC bots, etc.)
My inbound traffic is consistently 5-10 times higher than my outbound traffic. (For example, over the past 24 hours I have served 228MB of data, but received 1.94GB.)
Is this standard/expected for a web server? (Am I perhaps getting slammed with thwarted nefarious attempts whose packet size versus a 0-byte response overwhelms the normal inverse relationship?)
If this is not expected, what tools should I use to investigate where the traffic is coming from? (The server is running Ubuntu 10.04.)