We run a mail server (postfix/dovecot/centos 6.4). The hardware is based on a supermicro chasis with IPMI features.
It also runs a web interface for accesisng mails(Apache web server )
Recently our DC said that we are sending outbound DDOS attacks which touched upto 1.3Gbps as per their saying. They nulled the IP. After our request they re activated the IP again.
Now we are monitoring the server regulerly and seeing abnormal outbound traffcis at a avearge rate of 2mbps we dont sent that much emails) with peaks of upto 30mbps after each 30minutes period.(as per the data of New Relic Monitor)
The provider said that we might be running DDOS reflection attacks. The server logins are safe and authentication log says nothing abnormal
We dont have any DNS server running. Also NTP is running in client mode and it is secured.
nettop, iptraffic,nethogs show everything normal, only transmitted and recieved traffic summary in ifconfig says about the large amount of data sent.
Also we disabled NTP client on our IPMI as i read that supermicro IPMI is vulnerable to NTP reflection DDOS.
AT this point I am clueless and seeking help from experts here. Helps will be appreciated!
tcpdump
during one of the "busy" periods. That would give a first idea of what kind of traffic it was, which has got to be a first step in understanding how you're producing it - if you are.ifconfig
statistics are rapidly increasing).