Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Two days ago I've started experiencing Internet problems. My Desktop and another computer(web server) are connected to the Internet through router. In the munin monitor on the server I haven't found nothing interesting except high Firewall Throughput. As you can see from the screenshot it is very high even in the night.

Would could cause this? I thought it could be some attacker, but I haven't discovered anyone in the netstat.

alt text

  • Ubuntu Server 10.04.1
  • Apache 2.2
  • php5.3

Maximum server load is about 60-75%

share|improve this question

4 Answers 4

At least your munin stats are new. But within the few monitored days it is possible to see change on the last two days.

I assume your pc's are turned of in the night - the only active device would be your firewall.

Please check the firewall for infections with rootkit_hunter: http://www.rootkit.nl/projects/rootkit_hunter.html

I think your firewall is new and you should check for updates.

Please check which ports are opend from the internet side: http://www.yougetsignal.com/tools/open-ports/

share|improve this answer

Does your router have the ability to show IP's connected? Any of those showing a lot of strange activity?

TCPdump may show what's going through the connection. You could route traffic from your router to a virtual machine and forward it from there so you could sniff intercepted traffic and see what's going through the connection.

Anything unusual in the logs on any machines?

What about network interface statistics on your machines? Reset statistics and see what's going on there.

If your machines are disconnected for a period of time from the network, is your router still showing high levels of activity?

Does your router show connected workstations to it, or can you sniff for MAC addresses and/or rogue IP's on your network if you have wireless?

Did you run virus/malware scans on all your machines, keeping in mind that they can only tell you whether you ARE infected, not that you aren't (in other words, it's not 100% reliable since malware can cloak itself if it's clever)?

The best thing to try doing in my opinion is get another machine in the network to sniff network traffic and look for anomalies. If I'm reading your traffic stats correctly you're getting a huge amount of incoming traffic, not much outgoing, so either someone is downloading a lot of stuff or you're being hit with some kind of probe or attack. If you can't narrow it down in your network contact your ISP and see if they can see what's coming into your connection from their side; they should be able to determine a little better if you're under a denial of service attack. Check your router, check with packet sniffers, check using a clean VM and redirect all traffic with ARP poisoning to see if you can detect where the activity is coming from.

If you have wireless, try shutting that off to determine if there's another person on your network (if you don't have a router/AP that tells you the MAC of attached workstations already).

share|improve this answer

It is possible that one of your machines are infected, and it's your machine attacking others.

share|improve this answer

Give a try to iptraf to monitor connections activity. If there is a connection that's eating the bandwidth, you'll see it.

Also, if this is caused by connections on non open port, you won't see it with netstat (only list connections on open sockets). Try to log with netfilter and/or with tcpdump.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.