0

I have a Debian 6.0 server and everything was running fine with it. This server is my environnement so I can develop web application.

Since yesterday, the server is doing something to the network and I don't know how to find the source. Everytime the server is plugged in the network, the switch and the router go crazy and the network doesn't work fast anymore. I get 2654ms when I ping Google. However, when I ping another computer I still get 1ms. This only mean that the problem is between my server and Internet. The router is so busy that he don't answer when you contact it. If I unplug my server, everything goes back to normal. If I plug it back, I can see the LED on the switch flashing crazy like it's gonna blow.

Is there a way to isolate the problem ? I have no clue at all.

Thanks you.

David Bélanger
  • 227

3 Answers3

3

Sounds like the server has been infected and you need to reinstall it.

MikeyB
  • 40,079
1

It's a shot in the dark, but does your Debian server have an Intel 82574L ethernet controller? If yes, take a look at http://blog.krisk.org/2013/02/packets-of-death.html

weeheavy
  • 4,149
  • 1
  • 30
  • 41
1

Try to identify the process which is generating all the traffic. One useful utility would be nethogs. Once you have identified the process, use lsof to see all the files opened by that program and look for any suspicious looking files, in case your server is infected.

Daniel t.
  • 9,619