What do these logs mean? Am I attacking someone?

Question

This night my server got put in an "anti-hack" mode where I could only use a read-only FTP to download my data.

They told me that I was being a threat to the network, and that these were the logs that led to the alert:

Attack detail : 82Kpps/25Mbps
dateTime                   srcIp:srcPort           dstIp:dstPort           protocol flags       bytes reason
2016.04.24 03:04:13 CEST   MY_IP:44530     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:35962     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:18864     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:16468     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:2619      8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:62047     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:7871      8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:12277     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:8326      8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:20403     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:18801     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:19608     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:35276     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:43425     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:43856     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:41362     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:1385      8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:38576     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:1623      8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:54750     8.8.8.8:53              TCP      RST            40 ATTACK:DNS

Where MY_IP is obviously my server's IP address.

1. What is it happening?
2. Am I attacking someone?
3. Am I getting attacked?
4. Isn't 8.8.8.8 google's DNS?

Answer 1

This looks like your server is being used in a DNS amplification attack[1][2][3].

This means that your server is bombarding Google's DNS server with queries, so yes your server is being used to attack Google.

You are not being attacked, your server has been compromised and being used to attack someone else, in this case it looks like that it is Google.

8.8.8.8 is Google's publicly available DNS service

Is/was your server fully patched? Where all your ports locked down except the ones you need? Do you have any weak passwords?

1. https://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack/
2. http://whatis.techtarget.com/definition/DNS-amplification-attack
3. https://en.wikipedia.org/wiki/Reflection_attack