Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
My server's been hacked EMERGENCY

I run a couple of sites on Ubuntu via Rackspace Cloud Server. My site typically uses about 3 GB of outbound bandwidth a day. Today, I was shocked to discover that for the past week, my server has logged 2 Terabytes of outbound bandwidth a day. This is obviously completely abnormal and is costing me an arm and a leg. Interestingly, awstats shows my sites have been using the typical amount of bandwidth, so it's something else that's causing this ridiculous spike.

I suspect my site has been hacked. I ran root checks, went through my server logs, and found nothing suspicious. Do you guys have ideas on what else I can do to figure this out?

share|improve this question

marked as duplicate by jscott, l0c0b0x, Zoredache, EEAA, Wesley Mar 15 '12 at 0:36

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

I'd start by having RackSpace shutdown all outbound traffic from your server at the firewall with the exception of traffic which is coming from port 80. Then setup new VMs, migrate your data and inspect the compromised machines VM later using what you've learned to better secure your new server.

share|improve this answer
that's kind of bad advise, obviously the OP has some serious security issues with his sites and his setup, it would be wise to try and find those issues or else he will soon be in trouble again.. – Niko S P Mar 15 '12 at 0:25
He can always keep the VM around and do analysis on it later. Right now he's spending money like crazy on bandwidth. First problem stop spending money on nothing. Second problem find the whole and plug it. – mrdenny Mar 15 '12 at 0:36
you are right about that, but i suggest editing your answer to reflect the "keep the vm and analyse" part. – Niko S P Mar 15 '12 at 2:12
That's a fair point. I've updated it. – mrdenny Mar 15 '12 at 2:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.