Vild trafik fra apache
Jeg har en FreeBSD med apache og mysql, der har kørt i årevis uden problemer. Den kører ca. ti wordpress sites. I årevis har jeg intet gjort ved de sites, men forleden installerede jeg et nyt site med nyeste wordpress og et par plugins. Herefter blev netværket blokeret af fuld belastning af switchen, og jeg kan se dette i min firewall:Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188209 for int-dmz:172.16.0.50/56396 (87.116.46.7/56396) to int-Internet:223.25.2.3/988 (223.25.2.3/988)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188210 for int-dmz:172.16.0.50/50072 (87.116.46.7/50072) to int-Internet:223.25.2.3/1230 (223.25.2.3/1230)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188211 for int-dmz:172.16.0.50/56231 (87.116.46.7/56231) to int-Internet:223.25.2.3/2693 (223.25.2.3/2693)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188212 for int-dmz:172.16.0.50/64670 (87.116.46.7/64670) to int-Internet:223.25.2.3/3740 (223.25.2.3/3740)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188213 for int-dmz:172.16.0.50/56175 (87.116.46.7/56175) to int-Internet:223.25.2.3/5434 (223.25.2.3/5434)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188214 for int-dmz:172.16.0.50/63436 (87.116.46.7/63436) to int-Internet:223.25.2.3/4060 (223.25.2.3/4060)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188215 for int-dmz:172.16.0.50/64101 (87.116.46.7/64101) to int-Internet:223.25.2.3/3362 (223.25.2.3/3362)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188216 for int-dmz:172.16.0.50/51587 (87.116.46.7/51587) to int-Internet:223.25.2.3/5957 (223.25.2.3/5957)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188217 for int-dmz:172.16.0.50/55685 (87.116.46.7/55685) to int-Internet:223.25.2.3/4705 (223.25.2.3/4705)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188218 for int-dmz:172.16.0.50/58333 (87.116.46.7/58333) to int-Internet:223.25.2.3/3079 (223.25.2.3/3079)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188219 for int-dmz:172.16.0.50/59237 (87.116.46.7/59237) to int-Internet:223.25.2.3/2352 (223.25.2.3/2352)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188220 for int-dmz:172.16.0.50/56175 (87.116.46.7/56175) to int-Internet:223.25.2.3/4079 (223.25.2.3/4079)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188221 for int-dmz:172.16.0.50/61548 (87.116.46.7/61548) to int-Internet:223.25.2.3/5515 (223.25.2.3/5515)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188222 for int-dmz:172.16.0.50/51844 (87.116.46.7/51844) to int-Internet:223.25.2.3/5770 (223.25.2.3/5770)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188223 for int-dmz:172.16.0.50/58278 (87.116.46.7/58278) to int-Internet:223.25.2.3/4121 (223.25.2.3/4121)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188224 for int-dmz:172.16.0.50/64283 (87.116.46.7/64283) to int-Internet:223.25.2.3/4529 (223.25.2.3/4529)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188225 for int-dmz:172.16.0.50/53032 (87.116.46.7/53032) to int-Internet:223.25.2.3/5353 (223.25.2.3/5353)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188226 for int-dmz:172.16.0.50/64253 (87.116.46.7/64253) to int-Internet:223.25.2.3/5555 (223.25.2.3/5555)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188227 for int-dmz:172.16.0.50/61640 (87.116.46.7/61640) to int-Internet:223.25.2.3/1719 (223.25.2.3/1719)
Jun 4 01:03:54 fw %FWSM-6-302015: Built outbound UDP connection 145196055501188228 for int-dmz:172.16.0.50/64293 (87.116.46.7/64293) to int-Internet:223.25.2.3/5899 (223.25.2.3/5899)
Jeg kan se apache er synderen. Men kan det være et bestemt site? Er det apache, der er inficeret? Hvordan fejlsøger jeg videre?
