To Providers: What processes and netstat results do you search for to detect abuse?

serverian

^

Damian

BradND

probably shouldn't post this publicly -> rename file and gg

Rallias

ps -Af | grep java | grep shark
ps -Af | grep "./x"

There's a couple others... ./x is an IRC DDoS botnet. Shark just eats up a shitton of CPU. There's another botnet that resides in a ~/g*** folder (can't remember exactly atm).

@BradND said: probably shouldn't post this publicly -> rename file and gg

The problem is, most dumbass's compile from source and don't remove the source. You can rename the file, but I still recognize the code.

Damian

Good point!

serverian

What about to detect torrenting?

Rallias

@serverian said: What about to detect torrenting?

ps -Af | grep python | grep torrentflux
ps -Af | grep transmission
ps -Af | grep rtorrent

The latter two are annoying, kill on detection if node's got a high %LA. The first one is never the cause, only kill if DMCA.

serverian

@Rallias, what about netstat output scanning?

Damian

http://www.google.com can answer your questions, and many more....

serverian

@Damian, what is that site? Is it new?

seriesn

I would not share these info on public. This will just make it easier for the abusers to abuse my system, knowing and what to rename.

serverian

Yeah, ask something that would help many and get accused that you are trolling. You are all paranoid.

eastonch

@Seriesn it's unlikely a knowledgeable abuser would use standard file naming conventions.

We've had './happy-fun-time.sh' doing port scans to MiT, oh, and './anal.sh' doing brute forcing to some turkish ISP.

The irony.

Damian

@serverian said: You are all paranoid.

Said the non-provider :P

Wintereise

ps | grep

pgrep, please.

ps -Af | grep java

<Whee, appears I missed a pipe. Oh well>

eastonch

@Wintereise there's lots of abuse scripts using java

serverian

@Damian said: Said the non-provider :P

How would you know I'm not a provider? lol

Rallias

@serverian said: @Rallias, what about netstat output scanning?

What's netstat?

Rallias

@Wintereise said: This is an outrage, running Java is not a sign of abuse.

Sure, completely ignore the part after the second pipe.

Wintereise

@eastonch said: @Wintereise there's lots of abuse scripts using java

Same could be said about C/C++ (Say hello to 'native programs,' might as well start killing those too.)

It applies to every language. You should be filtering by CPU time used, not process names. Some people auto kill/ionice rTorrent/transmission too, which is also not nice, learn to use ioTop rather than being lazy.

An idle rTorrent/Deluge/Transmission instance is probably not causing you issues.

Wintereise

@Rallias said: Sure, completely ignore the part after the second pipe.

Now that you point that out, logging incoming/outgoing data of one's VM should also not be abuse -- assuming your 'shark' actually points to wireshark.

serverian

@Rallias said: What's netstat?

It's a rare life form found in eastern Kiribati that can survive only by feeding trolls.

seriesn

@eastonch said: @Seriesn it's unlikely a knowledgeable abuser would use standard file naming conventions.

We've had './happy-fun-time.sh' doing port scans to MiT, oh, and './anal.sh' doing brute forcing to some turkish ISP.

The irony.

Now, only the smart ones know, later, even the dumber ones would know, making my life hell at my dayjob :P

Rallias

@Wintereise said: Now that you point that out, logging incoming/outgoing data of one's VM should also not be abuse -- assuming your 'shark' actually points to wireshark.

Wireshark wouldn't get picked up by grep java.

@Wintereise said: Some people auto kill/ionice rTorrent/transmission too, which is also not nice, learn to use ioTop rather than being lazy.

I don't autokill. I do use the available heuristic tools to see if it ACTUALLY is causing a mess. I'm just saying transmission and rtorrent often are the case and I kill on site if that is the case. Most the time if I'm feeling nice and they've not attracted a DMCA I'll just drop in and restart the service.

seriesn

@serverian said: It's a rare life form found in eastern Kiribati that can survive only by feeding trolls.

Don't forget to add salt with it. It makes everything better.

serverian

@seriesn said: Don't forget to add salt with it. It makes everything better.

Yes, and just a pinch of black pepper.

Wintereise

@Rallias said: Wireshark wouldn't get picked up by grep java.

The only other Shark I can think of is the one that adds Velocity markup.

Shark is an open-source preprocessor for Java that lets you do more with less. Shark makes Java sharper by adding Apache Velocity-style
foreach loops and property getters, C#-style property setters, and more. 

Which one do you mean anyway?

@Rallias said: I don't autokill. I do use the available heuristic tools to see if it ACTUALLY is causing a mess. I'm just saying transmission and rtorrent often are the case and I kill on site if that is the case. Most the time if I'm feeling nice and they've not attracted a DMCA I'll just drop in and restart the service.

That wasn't really aimed at you, apologies if it seemed like that. More of a general statement that I've noticed among a few providers here -- some of whom even shared the fact on IRC.

Rallias

@Wintereise said: Which one do you mean anyway?

There's a shark.jar that I encountered recently that all it does is forkbomb (I decompiled it to be sure).

Wintereise

Ah, okay. Never encountered it anywhere though, hmm.

Fair enough.

concerto49

@Wintereise said: Same could be said about C/C++ (Say hello to 'native programs,' might as well start killing those too.)

kill Wintereise.exe

Wintereise

I'm extension-less, pffft.