Server performed a ping by itself? 1

[jimmyz66]

This is kind of weird on Saturday I was installing patches to all my servers as well as my firewall, while I was rebooting "server1" I saw in the traffic monitor on my fire wall that "server1" performed a ping test? Anybody seen this before, any ideas are as always appreciated.

 

[SgtB]

Does it ping every time you reboot? Where does it ping? Do an nslookup/dig on the IP address, and find out where its going to. Or do a whois (

http://www.samspade.com)

on the IP and find out who owns it. Once you figure that out, you can narrow it down to which application might be pinging...if it is an application. Your server may have been compromised. Do you allow any external access to ther server? (ie http,ftp,etc.)
If that's the case I suggest a rebuild. If rebuild is not an option, you'll have to find out how the intruder got in...block it...then remove infected files. ________________________________________
Check out

http://www.security-forums.com

 

[jimmyz66]

SgtB,

This is the first time I saw it I didn’t copy down the ip address (Big Mistake) and there are no external access to the server other then my ISP which is through my firewall. I had a bad feeling that this was happening my LAN has slowed down considerably and I chalked it up to a new SQL database we installed, I will do a reboot and get that address and go from there thank you for your help...