Looks like I'm currently under a DOS attack or something like that, I've been monitoring the traffic on the server using jnettop, this is a of what I see during normal conditions:
and this is an example of when the issue is happeing:
SO my question is: what does that "IP" in protocol and also "0" in port means????
I replaced the ip of my server with: 126.96.36.199 to make it more readable. Of course this is just an entry of the output, in nomral operation the list has many more entries, and when I'm under the attack, also I see several entries with the same HUGE RX and 0 TX, so the solution is not just block that IP in the example.