Looks like I'm currently under a DOS attack or something like that, I've been monitoring the traffic on the server using jnettop, this is a of what I see during normal conditions:
and this is an example of when the issue is happeing:
SO my question is: what does that "IP" in protocol and also "0" in port means????
I replaced the ip of my server with: 220.127.116.11 to make it more readable. Of course this is just an entry of the output, in nomral operation the list has many more entries, and when I'm under the attack, also I see several entries with the same HUGE RX and 0 TX, so the solution is not just block that IP in the example.