这里就简单说说这个流量跑高。
首先我从cacti 中监控到了一台放在机房的服务器流量异常,何为异常这里说一下:本身这台服务器交换机中限制带宽为两兆峰值,而他却可以跑到100M,按正常情况来说,当你的服务器流量跑满的时候,你的机器会很卡、远程连接会掉线或者根本连不上,所以正常流量来看,是绝对不会跑到100M的,所以这叫流量异常。下面给大家看一下图:
一、
那么当我发现异常后,我就查资料表找出这台机器的IP地址还有系统信息等等。
最终判定这是一台CentOS 5.4 密码为数字加大小写。以下是我查看到的一些信息:
[root@aaa ~]# iptables -L -n
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
这是防火墙规则
[root@aaa ~]# netstat -anpt
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:60003 0.0.0.0: LISTEN 3552/cupsdd
tcp 0 0 0.0.0.0:5801 0.0.0.0: LISTEN 2569/Xvnc
tcp 0 0 0.0.0.0:5802 0.0.0.0: LISTEN 2613/Xvnc
tcp 0 0 0.0.0.0:3306 0.0.0.0: LISTEN 2506/mysqld
tcp 0 0 0.0.0.0:14379 0.0.0.0: LISTEN 3516/ora_d000_thdb
tcp 0 0 0.0.0.0:5803 0.0.0.0: LISTEN 2674/Xvnc
tcp 0 0 0.0.0.0:5901 0.0.0.0: LISTEN 2569/Xvnc
tcp 0 0 0.0.0.0:5902 0.0.0.0: LISTEN 2613/Xvnc
tcp 0 0 0.0.0.0:5903 0.0.0.0: LISTEN 2674/Xvnc
tcp 0 0 119.57.51.103:80 221.209.56.114:27808 SYN_RECV -
tcp 0 0 119.57.51.103:80 221.209.56.114:27807 SYN_RECV -
tcp 0 0 119.57.51.103:80 206.217.132.75:2229 SYN_RECV -
tcp 0 0 119.57.51.103:80 121.232.7.242:51370 SYN_RECV -
tcp 0 0 119.57.51.103:80 182.185.216.13:53534 SYN_RECV -
tcp 0 0 119.57.51.103:80 111.161.23.92:37697 SYN_RECV -
tcp 0 0 119.57.51.103:80 157.55.35.96:18323 SYN_RECV -
tcp 0 0 119.57.51.103:80 125.39.163.95:30525 SYN_RECV -
tcp 0 0 119.57.51.103:80 183.3.87.80:51903 SYN_RECV -
tcp 0 0 119.57.51.103:80 221.209.56.114:27806 SYN_RECV -
tcp 0 0 119.57.51.103:80 221.209.56.114:27809 SYN_RECV -
tcp 0 0 0.0.0.0:1521 0.0.0.0: LISTEN 3426/tnslsnr
tcp 0 0 0.0.0.0:6001 0.0.0.0: LISTEN 2569/Xvnc
tcp 0 0 0.0.0.0:6002 0.0.0.0: LISTEN 2613/Xvnc
tcp 0 0 0.0.0.0:6003 0.0.0.0:* LISTEN 2674/Xvnc
tcp 0 1 127.0.0.1:50865 127.0.0.1:1521 SYN_SENT 3494/ora_pmon_thdb
tcp 0 0 119.57.51.103:32005 202.103.178.76:10991 ESTABLISHED 3648/atdd
tcp 0 0 119.57.51.103:32007 202.103.178.76:10991 ESTABLISHED 4059/atdd
tcp 0 0 119.57.51.103:32006 202.103.178.76:10991 ESTABLISHED 3760/atdd
tcp 0 0 119.57.51.103:32008 202.103.178.76:10991 ESTABLISHED 3881/atdd
tcp 0 0 119.57.51.103:32011 202.103.178.76:10991 ESTABLISHED 4472/atdd
tcp 0 0 119.57.51.103:32012 202.103.178.76:10991 ESTABLISHED 4300/atdd
tcp 0 0 119.57.51.103:32015 202.103.178.76:10991 ESTABLISHED 4617/atdd
tcp 0 0 119.57.51.103:32014 202.103.178.76:10991 ESTABLISHED 4198/atdd
tcp 0 0 119.57.51.103:64255 121.12.110.96:10991 ESTABLISHED 3558/ksapd
tcp 0 0 119.57.51.103:64259 121.12.110.96:10991 ESTABLISHED 3832/ksapd
tcp 0 0 119.57.51.103:64258 121.12.110.96:10991 ESTABLISHED 3652/ksapd
tcp 0 0 119.57.51.103:64257 121.12.110.96:10991 ESTABLISHED 4527/ksapd
tcp 0 1 119.57.51.103:51903 112.90.252.76:10991 SYN_SENT 4544/kysapd
tcp 0 1 119.57.51.103:51902 112.90.252.76:10991 SYN_SENT 4365/kysapd
tcp 0 1 119.57.51.103:51901 112.90.252.76:10991 SYN_SENT 4291/kysapd
tcp 0 1 119.57.51.103:51900 112.90.252.76:10991 SYN_SENT 3978/kysapd
tcp 0 1 119.57.51.103:51899 112.90.252.76:10991 SYN_SENT 3878/kysapd
tcp 0 1 119.57.51.103:51898 112.90.252.76:10991 SYN_SENT 4154/kysapd
tcp 0 1 119.57.51.103:51897 112.90.252.76:10991 SYN_SENT 3709/kysapd
tcp 0 1 119.57.51.103:51896 112.90.252.76:10991 SYN_SENT 3604/kysapd
tcp 0 1 127.0.0.1:5369 127.0.0.1:6113 SYN_SENT 3426/tnslsnr
tcp 0 0 :::80 ::: LISTEN 2879/httpd
tcp 0 0 :::6001 ::: LISTEN 2569/Xvnc
tcp 0 0 :::6002 ::: LISTEN 2613/Xvnc
tcp 0 0 :::6003 ::: LISTEN 2674/Xvnc
tcp 0 0 :::22 :::* LISTEN 2448/sshd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:157.55.34.74:57650 TIME_WAIT -
tcp 0 64 ::ffff:119.57.51.103:22 ::ffff:119.57.180.130:46177 ESTABLISHED 6691/sshd: root@not
tcp 0 29866 ::ffff:119.57.51.103:80 ::ffff:157.55.32.154:24818 FIN_WAIT1 -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:218.106.154.11:14554 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:218.106.154.11:13526 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:180.173.86.128:1107 TIME_WAIT -
tcp 0 6692 ::ffff:119.57.51.103:22 ::ffff:114.250.249.21:56821 ESTABLISHED 7269/0
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:182.118.19.211:10424 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:60.190.138.140:35502 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:221.224.14.222:59613 FIN_WAIT2 7271/httpd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:221.224.14.222:59615 ESTABLISHED 7506/httpd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:221.224.14.222:59614 FIN_WAIT2 7507/httpd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:221.224.14.222:59611 FIN_WAIT2 7505/httpd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:183.60.214.28:55574 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:182.118.19.109:46068 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:157.55.34.74:63141 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:157.55.34.74:11155 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:182.118.19.127:54739 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:218.106.154.11:15706 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:221.224.14.222:59617 FIN_WAIT2 7509/httpd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:221.224.14.222:59616 FIN_WAIT2 7508/httpd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:218.106.154.11:13094 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:182.118.28.30:29387 TIME_WAIT -
tcp 0 1 ::ffff:119.57.51.103:80 ::ffff:125.39.172.32:37149 LAST_ACK -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:157.55.34.74:56558 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:218.106.154.11:13315 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:81.91.9.160:57503 FIN_WAIT2 -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:81.91.9.160:57499 FIN_WAIT2 -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:183.60.213.114:45041 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:60.176.253.144:30624 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:182.118.21.34:16701 ESTABLISHED 7450/httpd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:60.176.253.144:30626 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:60.176.253.144:30627 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:60.176.253.144:30628 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:60.176.253.144:30620 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:157.55.35.96:58678 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:206.217.132.75:2132 FIN_WAIT2 7276/httpd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:157.55.35.96:50474 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:61.55.192.181:3096 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:61.55.192.181:3095 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:61.55.192.181:3094 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:61.55.192.181:3093 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:81.91.9.160:57505 FIN_WAIT2 -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:157.55.35.96:64322 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:182.118.19.84:61477 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:49.81.2.181:8203 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:49.81.2.181:8200 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:49.81.2.181:8204 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:49.81.2.181:8218 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:60.176.253.144:30754 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:49.81.2.181:8211 TIME_WAIT -
tcp 0 37440 ::ffff:119.57.51.103:80 ::ffff:118.250.130.121:7924 ESTABLISHED 6929/httpd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:49.81.2.181:8210 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:157.55.35.96:38531 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:49.81.2.181:8214 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:49.81.2.181:8213 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:49.81.2.181:8212 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:111.164.196.141:9503 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:111.164.196.141:9504 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:61.55.192.181:3231 FIN_WAIT2 -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:61.55.192.181:3230 FIN_WAIT2 -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:110.177.0.129:60133 ESTABLISHED 7518/httpd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:110.177.0.129:60132 ESTABLISHED 7512/httpd
tcp 0 21900 ::ffff:119.57.51.103:80 ::ffff:157.55.33.50:48368 ESTABLISHED 7514/httpd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:111.164.196.141:9530 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:110.177.0.129:60134 ESTABLISHED 7442/httpd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:110.177.0.129:60129 ESTABLISHED 7516/httpd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:111.164.196.141:9532 FIN_WAIT2 -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:110.177.0.129:60131 ESTABLISHED 7517/httpd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:110.177.0.129:60130 ESTABLISHED 7519/httpd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:111.164.196.141:9543 TIME_WAIT -
tcp 0 1 ::ffff:119.57.51.103:80 ::ffff:111.164.196.141:8519 LAST_ACK -
tcp 0 1 ::ffff:119.57.51.103:80 ::ffff:111.164.196.141:8520 LAST_ACK -
tcp 0 1 ::ffff:119.57.51.103:80 ::ffff:111.164.196.141:8521 LAST_ACK -
tcp 0 2602 ::ffff:119.57.51.103:80 ::ffff:157.55.35.96:12748 FIN_WAIT1 -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:121.232.7.242:51371 TIME_WAIT -
tcp 0 1331 ::ffff:119.57.51.103:80 ::ffff:182.185.216.13:53468 ESTABLISHED 7440/httpd
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:60.176.253.144:30810 TIME_WAIT -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:81.91.9.160:57459 FIN_WAIT2 -
tcp 0 0 ::ffff:119.57.51.103:80 ::ffff:60.176.253.144:30812 TIME_WAIT -
这是监听的端口及运行的进程 可以看到好多atdd ksapd kysapd 还有一个cupsdd 这些都是不正常的进程
[root@aaa ~]# cat /etc/rc.local
#!/bin/sh
This script will be executed after all the other init scripts.
You can put your own initialization stuff in here if you don't
want to do the full Sys V style init stuff.
nohup /etc/cupsdd > /dev/null 2>&1&
cd /etc;./ksapd
cd /etc;./kysapd
cd /etc;./atdd
nohup /etc/cupsdd > /dev/null 2>&1&
cd /etc;./ksapd
cd /etc;./kysapd
cd /etc;./atdd
nohup /etc/cupsdd > /dev/null 2>&1&
cd /etc;./ksapd
cd /etc;./kysapd
cd /etc;./atdd
nohup /etc/cupsdd > /dev/null 2>&1&
cd /etc;./ksapd
cd /etc;./kysapd
cd /etc;./atdd
nohup /etc/cupsdd > /dev/null 2>&1&
cd /etc;./ksapd
cd /etc;./kysapd
cd /etc;./atdd
nohup /etc/cupsdd > /dev/null 2>&1&
cd /etc;./ksapd
cd /etc;./kysapd
cd /etc;./atdd
nohup /etc/cupsdd > /dev/null 2>&1&
cd /etc;./ksapd
cd /etc;./kysapd
cd /etc;./atdd
nohup /etc/cupsdd > /dev/null 2>&1&
cd /etc;./ksapd
cd /etc;./kysapd
cd /etc;./atdd
这是我的rc.local 文件 被加入了好多东西,网查发现正是这些东西导致服务器大量向外发包
那以上就是这次案例的一些文字东西了,在这里向大家说一声密码一定不能简单化,尤其是公网IP,处理方法的话就把他随机器启动的一些文件全部删除,把他添加的一些东西删除掉,不过 强烈建议重新做系统,安全要做好!
————————————————
版权声明:本文为CSDN博主「RedHat-小怪兽」的原创文章,遵循 CC 4.0 BY-SA 版权协议,转载请附上原文出处链接及本声明。
原文链接:https://blog.csdn.net/redhat_xiaoguaishou/article/details/19042147