# Network issues... Feels like I am being DOS'd

## matart

In the past 2 days my systems network has been running slow. It is a powerful systems with a 60 Mbps connection. This is my personal computer.

I looked at dmesg and saw the following: 

```
nf_conntrack: table full, dropping packet
```

A quick google and I see this is what people get when they have too many connections. This is my personal computer not a big web server.

I ran the following

```
/sbin/sysctl net.netfilter.nf_conntrack_count

net.netfilter.nf_conntrack_count = 849303
```

If I turn off my network this obvisouly dies. but after turning it back on after 5 minutes I jump up to this number. (it is so high because I thought I just needed an increase).

I now look through htop and see that my cpu is running hard (see attached imgur) with a process running 

```
cat resolv.conf
```

This looks fishy to me. I next install nethogs and see (see second photo) that I am sending out a bunch of data to random ips with random ports. I have turned off deluge, plex, nginx, mysql. I can not find what is sending this data.

HERE ARE THE PHOTOS

http://imgur.com/a/Nmh5Y

Any help is greatly appreciated.

----------

## eccerr0r

Your console-kit-daemon is going bonkers too... 

Do you see your /proc/interrupts count numbers for your Ethernet interrupts going through the roof too?

----------

## matart

It seems I am being used as a node for a DDOS. Any idea on how I can remove it.

If I kill the process then it will restart under a different name.

It will also remove itself.

How can I track down what is monitoring these processes.

----------

## eccerr0r

If your machine was truly compromised I'd suggest you reinstall from scratch.  There's really not much other way to ensure you're clean from hacking...

Not sure why console-kit-daemon forked so many times, should only be there once...  Actually perhaps this is normal for htop, I've never used this before...

/etc/resolv.conf should be a fairly short file, not sure why it's taking that much cpu time...

----------

## Ant P.

 *eccerr0r wrote:*   

> Not sure why console-kit-daemon forked so many times, should only be there once...  Actually perhaps this is normal for htop, I've never used this before...
> 
> /etc/resolv.conf should be a fairly short file, not sure why it's taking that much cpu time...

 

htop can show threads, that's normal.

A `cat` process with five child threads taking 130% cpu is not normal. That box is rooted, disconnect it from the net immediately, nuke it with DBAN and reinstall.

----------

