Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

My web host has informed me that my Fedora server is the source of an outbound DDoS attack on somebody. The web host didn't give any other information. How can I find out what process is doing the attack so that I can stop it? I realize this is vague but I think if I can view outbound traffic in some way I might be able to find the process that is sending it.

I appreciate I will need to find the point of entry once I have stopped the attack, and likely will need to re-image the server with updates.

Thanks in advance.

share|improve this question

marked as duplicate by dunxd, Michael Hampton, HopelessN00b, mgorven, mdpc Mar 16 '13 at 1:50

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
nethogs.sourceforge.net –  quanta Mar 15 '13 at 9:40
2  
That doesn't sound like a very good hosting company if they didn't provide you with any information about the nature of the DDOS and how they made their determination. –  joeqwerty Mar 15 '13 at 10:49
    
@quanta thanks, I will try that. @ joewerty - yes you're right about the host! –  Jason Mar 15 '13 at 11:36
    
Are you running a DNS server? It could be a DMS reflection attack. –  Zoredache Mar 15 '13 at 15:42
    
@Zoredache no not running a DNS server. –  Jason Mar 15 '13 at 15:56
show 1 more comment

2 Answers

You could use something like iptraf (available in a repo near you). This will tell you which ports are being used on your system and at what rate. Once you know which ports are being used you can then use netstat to find the process attached to each port. So if for example you identify that your port 6666 is active you can use

netstat -tunp | grep 6666
tcp   0  77352 192.168.254.188:56405  192.168.254.181:6666   ESTABLISHED 30072/nc

As you can see in this demo pid 30072 is using the port.

share|improve this answer
    
Thanks for the info I will give that a go. –  Jason Mar 15 '13 at 15:53
add comment

Please note that you may find nothing at all. There is a chance that your system has been compromised and the tools you are using don't give the correct answers they should. Even using the system for further analysis could lead to more problems if there's a backdoor and you are entering your passwords for example.

The only solution is to shut down the server and consider it being compromised. If you want to find the source in a safe way you'd had to examine the system in an isolated environment.

share|improve this answer
    
Good points, unfortunately it is hosted by a web host, the only way I can access it is via the Internet (no physical access), and I really want to eventually find the entry point if I can so that I can prevent it happening again. –  Jason Mar 15 '13 at 15:56
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.