- 论坛徽章:
- 0
|
本帖最后由 wolsey 于 2014-09-19 14:24 编辑
先发现机器流量异常,大概有几个T的数据流量
然后用lsof -i发现如下进程
[root@localhost tomcat]# lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
dhclient 3296 root 4u IPv4 9351 UDP *:bootpc
portmap 3377 rpc 3u IPv4 9571 UDP *:sunrpc
portmap 3377 rpc 4u IPv4 9572 TCP *:sunrpc (LISTEN)
rpc.statd 3430 root 3u IPv4 9690 UDP *:repcmd
rpc.statd 3430 root 6u IPv4 9681 UDP *:mcns-sec
rpc.statd 3430 root 7u IPv4 9698 TCP *:dwr (LISTEN)
hpiod 3694 root 0u IPv4 12668 TCP localhost.localdomain:2208 (LISTEN)
python 3699 root 4u IPv4 12686 TCP localhost.localdomain:2207 (LISTEN)
sshd 3712 root 3u IPv6 12737 TCP *:ssh (LISTEN)
cupsd 3721 root 4u IPv4 12780 TCP localhost.localdomain:ipp (LISTEN)
cupsd 3721 root 6u IPv4 12783 UDP *:ipp
avahi-dae 4216 avahi 13u IPv4 14048 UDP *:mdns
avahi-dae 4216 avahi 14u IPv6 14049 UDP *:mdns
avahi-dae 4216 avahi 15u IPv4 14050 UDP *:55784
avahi-dae 4216 avahi 16u IPv6 14051 UDP *:44259
mysqld 6287 root 11u IPv4 19508850 TCP *:mysql (LISTEN)
mysqld 6287 root 15u IPv4 1228731018 TCP localhost.localdomain:mysql->localhost.localdomain:49568 (ESTABLISHED)
mysqld 6287 root 16u IPv4 1228731022 TCP localhost.localdomain:mysql->localhost.localdomain:49570 (ESTABLISHED)
mysqld 6287 root 21u IPv4 1228731532 TCP localhost.localdomain:mysql->localhost.localdomain:50072 (ESTABLISHED)
mysqld 6287 root 22u IPv4 1228731534 TCP localhost.localdomain:mysql->localhost.localdomain:50073 (ESTABLISHED)
mysqld 6287 root 23u IPv4 1228731536 TCP localhost.localdomain:mysql->localhost.localdomain:50074 (ESTABLISHED)
sshd 13048 root 3u IPv6 1228613792 TCP localhost:ssh->localhost:54413 (ESTABLISHED)
java 14001 root 29u IPv6 1228731023 TCP *:8009 (LISTEN)
java 14001 root 31u IPv6 1228731525 TCP *:8010 (LISTEN)
java 14001 root 33u IPv6 1228731527 TCP localhost.localdomain:8005 (LISTEN)
java 14001 root 35u IPv6 1228731531 TCP localhost.localdomain:50072->localhost.localdomain:mysql (ESTABLISHED)
java 14001 root 110u IPv6 1228731017 TCP localhost.localdomain:49568->localhost.localdomain:mysql (ESTABLISHED)
java 14001 root 112u IPv6 1228731021 TCP localhost.localdomain:49570->localhost.localdomain:mysql (ESTABLISHED)
java 14001 root 125u IPv6 1228731533 TCP localhost.localdomain:50073->localhost.localdomain:mysql (ESTABLISHED)
java 14001 root 126u IPv6 1228731535 TCP localhost.localdomain:50074->localhost.localdomain:mysql (ESTABLISHED)
sshd 14362 root 3u IPv6 1228800218 TCP localhost:ssh->localhost:50145 (ESTABLISHED)
sshd 14446 root 3u IPv6 1228807126 TCP localhost:ssh->localhost:50168 (ESTABLISHED)
sshd 14585 root 3u IPv6 1228830128 TCP localhost:ssh->localhost:49896 (ESTABLISHED)
sshd 18120 root 3u IPv6 1241615260 TCP localhost:ssh->localhost:cwmp (ESTABLISHED)
hisetup 18319 root 4u IPv4 1241644402 TCP localhost:52964->61.147.103.21:icl-twobase1 (SYN_SENT)
getty 18324 root 4u IPv4 1241644902 TCP localhost:53464->61.147.103.21:icl-twobase1 (SYN_SENT)
vip_ah 18367 root 3u IPv4 1241643864 TCP localhost.localdomain:10808 (LISTEN)
被指向了一个台湾的服务器
kill这三个进程hisetup,getty,vip_ah 并删除了这3个进程对应的目录文件后
过1分钟时间,这3个进程又起来了,反复如此
谁知道怎么办啊? |
|