Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

Today someone phoned me that he was receiving port scans and lots of requests from the IPs of my server.

I indeed see a high memory usage of HTTPD requests in the logs. However, how can I trace this back to an infected website?

I used the Apache domain logs but can't find anything unusual.

share|improve this question
add comment

marked as duplicate by mgorven, mfinni, Michael Hampton, mdpc, EEAA Feb 22 '13 at 3:55

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

If somebody reports unusual traffic from your machine, you probably do want to confirm it is compromised before going down the road of dealing with a compromise (summary: rebuild). If the suspected attack is related to portscanning and other botnet like traffic, mirror traffic to another host that is running a protocol sniffer and look for anything not normal, which is basically anything that is not HTTP traffic. If you see signs of compromise there, then you know to follow the nuke it from orbit plan.

share|improve this answer
    
Install a Linux machine with wireshark so it gets the traffic generated by the suspect (or the equivalent), and check that the traffic really is originated by it and it is not some other machine maskerading as yours in order to throw investigators off track. –  vonbrand Feb 22 '13 at 2:55
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.