>
> I am having some strange issues with my web server. I think someone has
> hacked into our box and is using it for file sharing.
> Usually I have about 350 Megs of Up/Down bandwidth everyday verry
> consistently. Now since last night I have had about 3.5 Gigs of bandwidth
> usage and rising. How can I find out where it's going?
netstat -ao will tell you ports and process IDs.
> Is there some type of free port scanner that will give me a clue?
Try nmap from any unix box or visit www.grc.com from the suspected system. But since you run them from a specific host and the rogue process may be configured to respond only to some very specific IPs that may not work.
Naturally there are many more tools, but that would require some basic information such as the OS you are using and how much access you have to logging from upstream equipment.
Jochem
[Todays Threads] [This Message] [Subscription] [Fast Unsubscribe] [User Settings]
