Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a small webserver that running on Lighttpd 1.4 which steadily uses 250GB or less bandwidth for the past couple of months. But since May the traffic spikeed to more than triple of what it was. Nothing special was on my site to make its spike like that. When I checked with vnstat I found that 70% of the bandwidth is tx. I suspect I've been hacked and my webserver is becoming some sort of bot. ClamAV comes out with nothing and I already replaced the Joomla installation with a fresh one, early in June. But right now the traffic stayed the same.

My question, how can I monitor my server and look what is transmitting all that data out? My need to be done to pinpoint what is the culprit.

Can someone please point to the right way to solve this? Thank you.

share|improve this question
    
Did you do some accounting summary on your access logs? Might that be regular traffic? –  Michuelnik Jun 28 '12 at 8:03
add comment

1 Answer

A few things to try:

Use netstat -nltp to show listening processes. Look for anything you don't recognize, or not legit.

Use iftop -i <interface> to see who the remote peers are that are using the most bandwidth.

Use tcpdump -pnn -i <interface> <host> to determine which port the offender is using. Compare that with the netstat results.

When you find some hosts that you want to kill the connections for use the following:

iptables -A INPUT -s <ip.ad.dr.es> -j DROP

When you want to remove that iptables rule use the following:

iptables -D INPUT -s <ip.ad.dr.es> -j DROP

Be very careful not to filter your own IP address!

Good luck!

share|improve this answer
    
Thank you for the suggestions. WHat I did was stop lighttpd and run iftop -i eth1 but I still find a lot of connection going out. How to inspect what sending all this traffic out? –  Sam W. Jun 29 '12 at 9:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.