2

We run a mail server (postfix/dovecot/centos 6.4). The hardware is based on a supermicro chasis with IPMI features.

It also runs a web interface for accesisng mails(Apache web server )

Recently our DC said that we are sending outbound DDOS attacks which touched upto 1.3Gbps as per their saying. They nulled the IP. After our request they re activated the IP again.

Now we are monitoring the server regulerly and seeing abnormal outbound traffcis at a avearge rate of 2mbps we dont sent that much emails) with peaks of upto 30mbps after each 30minutes period.(as per the data of New Relic Monitor)

The provider said that we might be running DDOS reflection attacks. The server logins are safe and authentication log says nothing abnormal

We dont have any DNS server running. Also NTP is running in client mode and it is secured.

nettop, iptraffic,nethogs show everything normal, only transmitted and recieved traffic summary in ifconfig says about the large amount of data sent.

Also we disabled NTP client on our IPMI as i read that supermicro IPMI is vulnerable to NTP reflection DDOS.

AT this point I am clueless and seeking help from experts here. Helps will be appreciated

  • Almost any decent advanced process monitor will show whence the traffic is being generated. Since your server is a DC, I'd assume you're running Windows Server. You can easily check the process generating the traffic using the Windows Performance Monitor (it's basically Task Manager on steroids) – Adi Mar 22 '14 at 20:46
  • What's the question? – TildalWave Mar 22 '14 at 21:25
  • We are using Cent OS and all local process monitors show normal traffic. CPU load and memory use is also normal. – user38427 Mar 23 '14 at 11:03
3

The first port of call might be to take a packet dump (ie, tcpdump) and see what it is you're throwing out.

  • 1
    I'd prefer something like "nettop": who's generating the traffic is likely to be more useful than what sort of traffic it is. – Mark May 18 '14 at 5:25
  • You can analyze the tcpdump saved packet capture with wireshark on some other computer and find out what sort of traffic is generated. Use netstat -na also to identify established connections. – Kasun May 18 '14 at 8:13
0

Maybe attaker has uploaded a php script in your web interface (somewere you have set its permission to 0777 or your upload script uploads your files there). You should find that file and delete it. And most important, make your web directory and scripts secure!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.