0

I have a small webserver that running on Lighttpd 1.4 which steadily uses 250GB or less bandwidth for the past couple of months. But since May the traffic spikeed to more than triple of what it was. Nothing special was on my site to make its spike like that. When I checked with vnstat I found that 70% of the bandwidth is tx. I suspect I've been hacked and my webserver is becoming some sort of bot. ClamAV comes out with nothing and I already replaced the Joomla installation with a fresh one, early in June. But right now the traffic stayed the same.

My question, how can I monitor my server and look what is transmitting all that data out? My need to be done to pinpoint what is the culprit.

Can someone please point to the right way to solve this? Thank you.

Improve this question
1
  • Did you do some accounting summary on your access logs? Might that be regular traffic?
    – Michuelnik
    Jun 28, 2012 at 8:03

3 Answers 3

Reset to default
1

A few things to try:

Use netstat -nltp to show listening processes. Look for anything you don't recognize, or not legit.

Use iftop -i <interface> to see who the remote peers are that are using the most bandwidth.

Use tcpdump -pnn -i <interface> <host> to determine which port the offender is using. Compare that with the netstat results.

When you find some hosts that you want to kill the connections for use the following:

iptables -A INPUT -s <ip.ad.dr.es> -j DROP

When you want to remove that iptables rule use the following:

iptables -D INPUT -s <ip.ad.dr.es> -j DROP

Be very careful not to filter your own IP address!

Good luck!

Improve this answer
1
  • Thank you for the suggestions. WHat I did was stop lighttpd and run iftop -i eth1 but I still find a lot of connection going out. How to inspect what sending all this traffic out?
    – Sam W.
    Jun 29, 2012 at 9:16
1

I used ntop and it allowed me to track every connection in a (quite) fancy way. netstat is another great tool (netstat -untap can help you along the way).

Improve this answer
0

I work for a network monitoring company and our solution would allow you to monitor the traffic coming out of your web server and diagnose exactly what is going on.

However, it sounds like you already know there is something compromised on your server. My suggestion, would be to completely bullet your server and start again. You can never trust a compromised server.

I am not sure of any free solutions for network traffic monitoring that will give you a nice visual guide as to what is happening. I have done market research as it is in my field.

Improve this answer
1
  • Assuming the server is hacked: Yes. Nuke it and restart fresh (including careful checks on the data which you restore to it). However discovering if this is the case might be useful before doing that. E.g. the server might be fine and someone in TX might just be hot linking to images on the server. (Which should show up in the http logs)
    – Hennes
    Sep 7, 2014 at 15:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .