How to search for script creating an “outbound denial of service attack (DOS)”

[canton]

I’ve just been told by my hosting company that my server is creating an “outbound denial of service attack (DOS)”.

Hosting company firewall logs show:-

09:52:17.768667 IP [local IP address].55901 > [destination IP address].113: UDP, length 1

09:52:17.768680 IP [local IP address].55901 > [destination IP address].113: UDP, length 1

09:52:17.768683 IP [local IP address].55901 > [destination IP address].113: UDP, length 1

09:52:17.768686 IP [local IP address].55901 > [destination IP address].113: UDP, length 1

09:52:17.768688 IP [local IP address].55901 > [destination IP address].113: UDP, length 1

….And so on
So I now have to trace the script e.t.c that is being used to create this attack.
How do I go about investigating the source of the problem? I use a tool called splunk if that helps.

Thanks in advance

[mikelanghorst]

If you have the *nix app running, and lsof enabled, you might be able to track it down by starting with the following search:
index=os sourcetype=lsof UDP | multikv | search

That will search for lsof events that contain UDP, break it into individual lines, then filter only those with destination IP.

[Brian_Osburn]

This isn't making very much sense. It looks like you're trying to connect from your server to port 113 on another server. Most likely you have some misconfigured application on your server. Unless you are indexing the application logs (and the logs themselves show connections), Splunk isn't going to be much help.

Best bet will be to do (if you have a *nix) box, is to do lsof | grep 113 - this will tell you what process is trying to connect.