My ISP has contacted me stating that unauthorized attacks are coming from my LAMP server. Here is part of the log they have attached:
15:26:16.821245 IP My.Ip.is.here.59987 > some.one.elses.ip.ssh: UDP, length 1
15:26:16.821248 IP My.Ip.is.here.59987 > some.one.elses.ip.ssh: UDP, length 1
15:26:16.821251 IP My.Ip.is.here.59987 > some.one.elses.ip.ssh: UDP, length 1
15:26:16.821253 IP My.Ip.is.here.59987 > some.one.elses.ip.ssh: UDP, length 1
How do I investigate this?