Linux under contract processing

Linux under contract Processing:

1. Use the top analysis tool to see which process consumes 2 more CPU resources. To see through the commands are those ports that are occupied by NETSTAT-ANTP |   More 3. Look in the top to see the exception process to the/proc directory to find the exception process number into the directory of process number execution ls-l look at the path of the file to determine whether the system file is not the case, use kill-9 xx or killall xx to kill the process 4. After the kill process continues to jump out of the words delete fileswhereis xxxps-ef greprm-rf xxx Windows method is the same asOpen the Task Manager to see if that process consumes CPU . 

the server package is the server sends the packet outward, the concrete manifestation is outward outgoing traffic becomes larger. It is most likely that the server's controller uses the server or server as a packet attack on other hosts as a broiler.
Can use the computer room Management system IP query, observe the flow chart. When the server is contracted out, the outgoing traffic of the server is high, the Green Line in the graph will be higher, and the packet will be full of bandwidth. In general, the server contracted, is the server was invaded, became someone else's broiler, the other host for traffic attacks.

A. Server contract processing under Windows:

1. First use the tool to query the server process, program traffic, such as: TCPView tool, find out the abnormal package program, the end.

2. Then Avira trojan, scan to repair the vulnerability of the server.

3. Turn on the firewall, close the unused ports, and make a security policy for the server.

Two. Server contract processing under Linux:

1. first grab the bag with TCPDUCM:

Tcpdump parameter Description:

-I with the Internet port-nn the IP address display-C means how many packets to grab

TCP UDP Port Port number

Example

It is also recommended to use the iftop tool to observe the flow

The Iftop tool is mainly used to show the local network traffic and the traffic sets of each other, such as the amount of traffic between the individual machines, and find out which IP the server traffic is destined to.
Iftop parameter explanation:

TX: Send traffic RX: Receive traffic total: overall traffic
Cumm: Running Iftop to the current total traffic peak: Traffic spikes rates: the average traffic for the past 2s, 10s, 40s <= = = is the direction of traffic.

-I set the monitoring network card, such as: # Iftop-i eth1

-B displays traffic in bytes (default is bits), such as: # Iftop-b

-N Causes the host information to display IP directly by default, such as: # Iftop-n

-N causes port information to be displayed by default directly, such as: # Iftop-n

-F shows incoming and outgoing traffic for a specific segment, such as # iftop-f 10.10.1.0/24 or # iftop-f 10.10.1.0/255.255.255.0
2. Use the Iptales command to set up firewall rules

from the crawled package, analyze which IP address to send the packet, and then directly prevent the sending data to the change address.

Iptables-a output-d Destination IP address-j DROP

or: If it is a UDP package, you can also prohibit the local sending UDP packets

Iptables-a output-p UDP--dport 53-j ACCEPT

Iptables-a output-p udp-j DROP

or, allow only the packets for the specified port to be sent natively.
For example:

Iptables-a output-p TCP--sport 22-j ACCEPT

Iptables-a output-p UDP--sport 53-j ACCEPT

Iptables-a output-p TCP--sport 53-j ACCEPT

Iptables-a output-p TCP--sport 80-j ACCEPT

Iptables-a output-p tcp-j DROP

Linux under contract processing