The company that hosts my dedicated server has alerted me to what they think is malicious traffic coming from my machine. They supplied me with graphs showing a large amount of UDP traffic coming from the IP address of my machine and another machine on their network, both directed at an address that seems to be a Russian webhost. The traffic lasted about 15 minutes, was about 80 Mbps, and occurred on a day when I was out of town and not logged in to the server or doing anything special with it. My machine is running debian. My webhost says they "removed the null route and it seems to not start again." (I don't know what that means.) I ran a rootkit detector called rkhunter and it didn't turn up anything.
I don't have any advanced knowledge of security, so it's hard for me to evaluate whether this is strong evidence that my machine has been compromised. I noticed the following in this answer:
Are you sure your server is the source of the packets? It's easy to forge the source address for UDP packets.
Is the information from my webhost strong evidence that my machine has been compromised and that I need to have them do a reinstall?
[EDIT] I later found out that this was probably because the portmapper service is vulnerable to something called a portmapper amplification attack, which uses UDP. Since I'm not using NFS, I can just turn this service off.