What caused that network spike?

Rebooting it may have made tracking it down even harder. The only way to see where all the traffic is going is to catch it in the act using a tool like tcpdump.

It's possible that this was legitimate traffic. However, would you expect your site to generate such a large amount of outbound traffic? On the other hand, it's quite possible that some malicious code was uploaded to your Linode by someone. I'd check recent logins, as well as look for any suspicious files or folders especially in directories where PHP would have write access.

-Tim

Thanks thechman - I found in the auth.log repeated attempts to login with root ssh from one IP around that time so I've blocked that IP with apf now.

You should make sure that root logins via ssh are disabled entirely and use SSH Key authentication with a passphrase to login.

Lots of inbound login attempts still wont explain your traffic spike though.

It's happening again now. I'm looking at tcpdump but not really sure what to look for. Any help?

I did disable root login via ssh and use passphrase only. I'm currently looking at NetHogs but the traffic seems to have returned to normal.

@creativetags:

It's happening again now. I'm looking at tcpdump but not really sure what to look for. Any help?

If you can catch it again you may want to try running this command and then placing it in a pastebin:

tcpdump -nc 1000 -i eth0 not port 22

We might be able to see exactly what it is.

-Tim

Ok, so I saw increased traffic again and captured this: http://paste2.org/p/2052798

I'm not 100% sure it was happening while that was taken as it seems to have stopped again.

I assume that "176.58.103.165" is your Linode's IP? It looks like your Linode is being used as a drone to attack other systems on the Internet. My personal recommended is to redeploy, and move all of your data over as well as audit it while you're moving it. You'll need to determine the attack vector to prevent it from happening again.

-Tim

Ok, I found some processes that pointed me to an out of data wordpress install. I've killed the processes, changed the passwords and upgraded wordpress. So far so good. Thanks for your help.