Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : Extremely high incoming traffic

[sytker]

Hello,
We've found out a abnormal usage of one of our servers, our RTG graphs shows:

Last 24h
IfInOctets: 30.5GB
MAX: 6.9MBits/s
AVG: 3.4Mbits/s
Cur: 4.7Mbits/s

And a strage traffic:
IfOutOctets: 42.5GB
MAX: 76.6MBits/s
AVG: 4.7Mbits/s
Cur: 600Kbits/s

We are running two websites on this server, and we looked at raw log apache, we've compilers disabled, we block most of outgoing / incoming packets on firewall, we ran chkrootkit, rkhunter and nothing was found. We checked for cronjobs, suspect files, netstat, but we can't see anything strange. We use the latest server software (apache 2.2.x), PHP 5.2.x, MySQL 4.1.x, we have most of the server optimized.

We are running iptraf now, and it seems normal:
│ Incoming rates: 85.8 kbytes/sec
│ Outgoing rates: 636.4 kbytes/sec

Anyone have an idea? And some way to properly monitor incoming traffic? I'm looking to find how/where is the source of this traffic.

Thanks

[david510]

Have you installed APF and blocked all unnecessary ingress/outgress ports?

[sytker]

Originally Posted by david510

Have you installed APF and blocked all unnecessary ingress/outgress ports?

We use CSF, and yes, we blocked all unnecessary ingress/outgress ports.

[david510]

Have you enabled hotlink protection to the domains?

[sytker]

Originally Posted by david510

Have you enabled hotlink protection to the domains?

Yes, I have. But the main problem is the incoming traffic, not the outgoing as when someone hotlinks the outgoing traffic increases.

[soundguy]

netstat -n | less

Look for IRC connections on 6666 and 6667 and anything else that's not web, email, or anything else you normally run on that machine.