<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body><div>Ken,</div><div>Thanks for the response Ken. I have alot of the traffic on port 111, but also other random ports.</div><div><br></div><div>This server does have a suspended Joomla 3x site. I am looking into that now, but the other 2 servers didn't have any Drupal, Joomla or WordPress sites. No active sites at all and they are also compromised. So I am thinking it is not a site but the base OS.</div><div><br></div><div><br></div><div style="font-size:100%;color:#000000"><!-- originalMessage --><div>-------- Original message --------</div><div>From: Ken Hohhof <khohhof@kwom.com> </div><div>Date: 4/21/18 10:00 AM (GMT-06:00) </div><div>To: blueonyx@mail.blueonyx.it </div><div>Subject: [BlueOnyx:21958] Re: BO5209 - increased outbound UDP traffic </div><div><br></div></div><div><span style="font-family: sans-serif;">Hello all,</span></div><div><font face="sans-serif"><br></font></div><div>On Tuesday night I began to see an increase in UDP traffic on 3 5209 boxes. I shut down 2 of the 3 as they were development boxes, but one has a live site. All 3 were producing about 600k outbound traffic continuously. Normal outbound traffic averages about 30k.</div><div><br></div><div>I checked my log files and didn't find anything too far out of norms. I did a TCPDump and saw hundreds of records of UDP to different ports.</div><div><br></div><div>I have been searching for the last few days for a solution, but wanted to check here before I did something foolish as I have done so many times in the past.</div><div><br></div><div>So any recommendations would be greatly appreciated.</div><div><br></div><div>Thanks,</div><div><br></div><div>John </div></body></html>