I am getting very slow Internet experience. In vnstat I see
rx: 4 kbit/s 3 p/s tx: 94.74 Mbit/s 14072 p/s^C
eth4 / traffic statistics
rx | tx
--------------------------------------+------------------
bytes 11.85 MiB | 30.30 GiB
--------------------------------------+------------------
max 6.86 Mbit/s | 94.93 Mbit/s
average 28.18 kbit/s | 73.80 Mbit/s
min 0 kbit/s | 0 kbit/s
--------------------------------------+------------------
packets 17127 | 37761168
--------------------------------------+------------------
max 584 p/s | 14108 p/s
average 4 p/s | 10964 p/s
min 0 p/s | 0 p/s
--------------------------------------+------------------
time 57.40 minutes
Using nethogs I see,
PID USER PROGRAM DEV SENT RECEIVED
2546 root su eth4 0.013 0.072 KB/sec
? root 192.168.7.100:58888-43.250.83.106:61878 0.021 0.025 KB/sec
? root 192.168.7.100:58888-70.24.39.90:65025 0.021 0.025 KB/sec
? root 192.168.7.100:44145-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:52239-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:15834-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:29433-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:49576-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:36540-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:32289-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:25437-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:10155-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:32125-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:59269-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:57686-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:2747-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:59482-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:58985-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:56246-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:4345-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:10665-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:40676-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:35600-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:12241-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:43541-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:19124-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:1676-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:37809-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:7017-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:14998-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:64834-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:31544-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:17969-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:57675-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:32002-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:1233-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:64445-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:51733-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:38604-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:63299-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:96-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:28078-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:40611-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:4304-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:43318-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:8573-115.28.112.60:7575 0.168 0.000 KB/sec
? root 192.168.7.100:51347-115.28.112.60:7575 0.168 0.000 KB/sec
It seems someone has run a torrent application and uploading everything from my pc. Not sure though.
How do i know what process is doing this nasty stuff? I need to stop and prevent it from happening in future also.
Am I being pawned?
Update
I have closed all the ports except sshd (22) by my routers firewall. Now I dont see this process. But now nethogs show this weird output.
PID USER PROGRAMDEV SENT RECEIVED
? root unknown TCP 0.000 0.000 KB/sec
netstat -natup
shows.115.28.112.60
in the output ofnetstat -natup
115.28.112.60
innetstat -natup
seems to indicate as much. Are you still having weird connections at this moment? Maybe post thenetstat -natup
-result or/and even theps aux
to see if there is a weird process running you don't recognize.