UPDATED! Network access problems

[mdahl]

Hi all,

Today it happend again, this time I checked the running processes. The www-data user was executing a command called 'S' and using 99.9 of the CPU. Also it seems like it eats all the bandwidth up as well. Have I been hacked?

I have a major problem with one of my Debian servers (2.4 kernel). The server is connected to internet via a switch to a router. On the same switch a LAN is connected through a firewall. Se picture below.

The server has been working fine for about a year but suddenly problems started to appear. For som reason the server stops responding and at some occations it blocks internet access to the rest of the network connected through the firewall.

By disconnecting the Debian server from the switch or by restaring it the problem will go away. Sometimes it isn't possible to log on to the server locally and I have to turn the power off to be able to restart it.

On the server i run; Apache, ProFTP, Named, Shorewall and Sendmail. I haven't been able to find out what is wrong. I have replaced the network card but I still have the same problem.

Pleae help me!

BR

Martin

      
       internet
           |
     router/modem
           |
        switch
     |         |
 my server   firewall
               |
              LAN

[ptrivino]

Hi all,

Today it happend again, this time I checked the running processes. The www-data user was executing a command called 'S' and using 99.9 of the CPU. Also it seems like it eats all the bandwidth up as well. Have I been hacked?

I have a major problem with one of my Debian servers (2.4 kernel). The server is connected to internet via a switch to a router. On the same switch a LAN is connected through a firewall. Se picture below.

The server has been working fine for about a year but suddenly problems started to appear. For som reason the server stops responding and at some occations it blocks internet access to the rest of the network connected through the firewall.

By disconnecting the Debian server from the switch or by restaring it the problem will go away. Sometimes it isn't possible to log on to the server locally and I have to turn the power off to be able to restart it.

On the server i run; Apache, ProFTP, Named, Shorewall and Sendmail. I haven't been able to find out what is wrong. I have replaced the network card but I still have the same problem.

Pleae help me!

BR

Martin

      
       internet
           |
     router/modem
           |
        switch
     |         |
 my server   firewall
               |
              LAN

Just addressing the "at some occations it blocks internet access to the rest of the network connected through the firewall" question: if the server is creating a LOT of traffic, it can definitely appear to block other internet traffic - the switch is made too busy to handle any other traffic. This is supported by internet working again after you disco the server. FWIW.