Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a Debian 6.0 server and everything was running fine with it. This server is my environnement so I can develop web application.

Since yesterday, the server is doing something to the network and I don't know how to find the source. Everytime the server is plugged in the network, the switch and the router go crazy and the network doesn't work fast anymore. I get 2654ms when I ping Google. However, when I ping another computer I still get 1ms. This only mean that the problem is between my server and Internet. The router is so busy that he don't answer when you contact it. If I unplug my server, everything goes back to normal. If I plug it back, I can see the LED on the switch flashing crazy like it's gonna blow.

Is there a way to isolate the problem ? I have no clue at all.

Thanks you.

share|improve this question
    
Is this running behind a firewall or NAT of some sort? That may help to narrow things down. –  Soviero Feb 7 '13 at 15:26
    
Boot the Deb6 hardware off a livecd, and reconnect. Do you still have problems? If yes, then hardware/wiring is messed up. If no then it is something running on the Deb6 box. Login, and see what is running. –  Zoredache Feb 7 '13 at 15:31
1  
First off, cool the hyperbole - your switch is not "gonna blow". You have a problem, troubleshoot it logically and methodically - you already determined this system is the culprit, so now put it on an isolated network and look at the traffic it produces. Run nettop or similar to see if it's a specific process causing the problem. Boot off a LiveCD to rule out a hardware issue. If you determine the box is compromised proceed per serverfault.com/questions/218005/… –  voretaq7 Feb 7 '13 at 17:29

3 Answers 3

Sounds like the server has been infected and you need to reinstall it.

share|improve this answer
    
Is there a way to isolate the % of use of the network per process ? –  David Bélanger Feb 7 '13 at 15:04
    
Yes - see Daniel's suggestion for nethogs or voretaq7's suggestion for nettop. –  MikeyB Feb 7 '13 at 18:06

It's a shot in the dark, but does your Debian server have an Intel 82574L ethernet controller? If yes, take a look at http://blog.krisk.org/2013/02/packets-of-death.html

share|improve this answer

Try to identify the process which is generating all the traffic. One useful utility would be nethogs. Once you have identified the process, use lsof to see all the files opened by that program and look for any suspicious looking files, in case your server is infected.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.