Archive

How to search for script creating an “outbound denial of service attack (DOS)”

New Member

I’ve just been told by my hosting company that my server is creating an “outbound denial of service attack (DOS)”.

Hosting company firewall logs show:-

09:52:17.768667 IP [local IP address].55901 > [destination IP address].113: UDP, length 1

09:52:17.768680 IP [local IP address].55901 > [destination IP address].113: UDP, length 1

09:52:17.768683 IP [local IP address].55901 > [destination IP address].113: UDP, length 1

09:52:17.768686 IP [local IP address].55901 > [destination IP address].113: UDP, length 1

09:52:17.768688 IP [local IP address].55901 > [destination IP address].113: UDP, length 1

….And so on
So I now have to trace the script e.t.c that is being used to create this attack.
How do I go about investigating the source of the problem? I use a tool called splunk if that helps.

Thanks in advance

Tags (1)
0 Karma

Motivator

If you have the *nix app running, and lsof enabled, you might be able to track it down by starting with the following search:
index=os sourcetype=lsof UDP | multikv | search

That will search for lsof events that contain UDP, break it into individual lines, then filter only those with destination IP.

Builder

This isn't making very much sense. It looks like you're trying to connect from your server to port 113 on another server. Most likely you have some misconfigured application on your server. Unless you are indexing the application logs (and the logs themselves show connections), Splunk isn't going to be much help.

Best bet will be to do (if you have a *nix) box, is to do lsof | grep 113 - this will tell you what process is trying to connect.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!