My graphs have always had a higher incoming traffic volume than outgoing. The ratio seems right but really this should be reversed for a webserver... (as i understand it) I have all ports bar 80 and ssh blocked for incoming traffic.

Is the graph reflecting the linode or the switchport? Is it possible that its reversed? What do other people's web server graphs look like?

What would be the best way of tracking down what's really going on?

Thanks a lot!

For a webserver it should be more outgoing than incoming. Tools for tracking bandwidth you could try munin, it makes nice graphs, and ntop which can run as a daemon and track what goes where (i.e. ssh, http etc etc)

_________________
Paid support
How to ask for help
1. Give details of your problem
2. Post any errors
3. Post relevant logs.
4. Don't hide details i.e. your domain, it just makes things harder
5. Be polite or you'll be eaten by a grue