This question already has an answer here:
Since a few days ago I've been observing some strange recurrent outgoing UDP traffic from my server on port 24441 but since it's not constant, I cannot seem to find what's causing it.
All I can see is the following in iptables logs:
Nov 15 00:46:33 server kernel: [17216276.676673] Firewall: *UDP_OUT Blocked* IN= OUT=eth0 SRC=<SERVER_IP> DST=184.108.40.206 LEN=192 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=60641 DPT=24441 LEN=172 UID=501 GID=513
I suspect it's some kind of malware running periodically from my server but want to find out what exactly. Can someone shed a light on how to catch this/log the source of this automatically when it happens? I'm running Centos 6.7. Thanks!