This question already has an answer here:
- How do I deal with a compromised server? 13 answers
My web host has informed me that my Fedora server is the source of an outbound DDoS attack on somebody. The web host didn't give any other information. How can I find out what process is doing the attack so that I can stop it? I realize this is vague but I think if I can view outbound traffic in some way I might be able to find the process that is sending it.
I appreciate I will need to find the point of entry once I have stopped the attack, and likely will need to re-image the server with updates.
Thanks in advance.