Is there an SSH command to see...
 

Is there an SSH command to see what's currently being downloaded from my server?

My bandwidth is getting raped the past few days, trying to see where it's all going...

netstat -p TCP
will show all active TCP connections....
not quite what you want but will show where things are going.

Thanks...

I just had my host install the server-status feature for Apache, which gave me exact file names being downloaded. I guess some bot was continuously downloading one of my galleries...

To stop that ripping, we have sale on Throttlebox today only. $75 off.
Use discount code "summersale" when you get the Strongbox + Throttlebox package.

that stop hotlinking of videos?

I only know of previous products called anti hotlink, and traffic guardian, is it like that? an apache module.

Yes, Throttlebox is an Apache module, with support scripts for runing reports and such.
The other "antihotlink" software is generally based on the referer header, which even the
clueless script kiddies know hot to spoof, if their ripper software doesn't do so automatically.
So that approach won't stop ripping. We use a different approach. You can read full details here:
http://bettercgi.com/throttlebox/ . Basically, we use two levels of protection. First, secure your
members' area with Strongbox so that only valid member's have any access to the members'
content. Second, Throttlebox lets you put intelligent limits so that users only download
a reasonable amount of content in a session, a day, or a couple of days. For the limits to
work well, it has to go a little beyond "X GBs in 24 hours". For example, 800MB of images,
which would be about a thousand images, is a lot different than 800MB of video, which may
be reasonable on some sites. So we treat images and videos separately. We also have
settings for both the NUMBER of videos and the NUMBER of images as well as the GBs
of video and GBs of images, etc. That makes sure that the user can use a reasonable
amoutn of content but can;t simply rip the site.

Also of course Strongbox has it's own ripper prevention, including bait links.
The automated ripper software hits the bait links and we detect that, plus there
are the parameters that Strongbox uses to allow any access to the members' area
in the first place, which will often stop a ripper cold before they can even a start.
So between Strongbox and Throttlebox we have several layers of protection against
ripping, none of it based on the easily spoofed referrer.