Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

Today someone phoned me that he was receiving port scans and lots of requests from the IPs of my server.

I indeed see a high memory usage of HTTPD requests in the logs. However, how can I trace this back to an infected website?

I used the Apache domain logs but can't find anything unusual.

share|improve this question

marked as duplicate by mgorven, mfinni, Michael Hampton, mdpc, EEAA Feb 22 '13 at 3:55

This question was marked as an exact duplicate of an existing question.

If somebody reports unusual traffic from your machine, you probably do want to confirm it is compromised before going down the road of dealing with a compromise (summary: rebuild). If the suspected attack is related to portscanning and other botnet like traffic, mirror traffic to another host that is running a protocol sniffer and look for anything not normal, which is basically anything that is not HTTP traffic. If you see signs of compromise there, then you know to follow the nuke it from orbit plan.

share|improve this answer
Install a Linux machine with wireshark so it gets the traffic generated by the suspect (or the equivalent), and check that the traffic really is originated by it and it is not some other machine maskerading as yours in order to throw investigators off track. – vonbrand Feb 22 '13 at 2:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.