5 ms·
Curious what monitoring system they have to detect things like that.
by 49i4 12y ago
Curious what monitoring system they have to detect things like that.
- meowface 12y agoLooks like the hosting provider picked up on it. Likely an IDS such as Snort or Suricata to detect compromised hosting clients. And possibly something to measure unusual traffic volume, or traffic to suspicious regions or hosts.
- dmix 12y agoAlso HIDS, such as OSSEC could detect tampering of the operating system. Such as a rootkit installing a module or modifying a bin.
- mobiplayer 12y agoThey were probably spamming someone else and choking some network uplink at their provider, which is why the provider itself told them about the possible compromise. Either that or killing other resources and raising very simple alerts (disk, CPU, RAM, Ethernet ports, etc).