I having a very strange issue in one of my servers which seem to lose connections every few minutes:it runs on a CentOS 6.5 64 bit arch and it frequently experiences network disconnections. I have isolated the fault through a series of TCPDUMPS, but i noticed my server seems to be making a few calls to an unknown IP Address on a destination port of 6004 10:26:09.323489 IP xxxx.43725 > 103.233.80.202.static.krypt.com.6004: Flags [S], seq 4085665640, win 14600, options [mss 1460,sackOK,TS val 57778507 ecr 0,nop,wscale 7], length 010:26:09.325540 IP 103.233.80.202.static.krypt.com.6004 > xxxxx.43725: Flags [S.], seq 1064636205, ack 4085665641, win 64240, options [mss 1400,nop,wscale 0,nop,nop,TS val 0 ecr 0,nop,nop,sackOK], length 010:26:09.325561 IP xxxxx.43725 > 103.233.80.202.static.krypt.com.6004: Flags [.], ack 1, win 115, options [nop,nop,TS val 57778509 ecr 0], length 010:26:09.325855 IP xxxxx.43725 > 103.233.80.202.static.krypt.com.6004: Flags [P.], seq 1:29, ack 1, win 115, options [nop,nop,TS val 57778509 ecr 0], length 28here is an example output of one of these connections via netstat :tcp        0      0 XX.XX.XX.XX:43730            103.233.80.202:6004         ESTABLISHED 1218/netstat -anIt seems to me that the connection is coming out of my server into an ip address in Thailand on port 6004.I traced this to a process run by root :root      1218     1 60 10:11 ?        00:14:49 netstat -anI have tried to block these IP addresses on iptables, but it only acts as a temporary solution. (as well as their associated process) but i notice that the problem will reoccur again in a couple of hours. for the time being i have stopped the server ,but i am not sure how to proceed from here. (Stopping short of a full re-install)Any ideas on what i can do to trace this to something on the server? 
Intermittent Network Connections - CentOS
linux;centos;networking
Your system seems to be compromised by a bot, I suspect. From your description, it may very well be a ChinaZ.DDOS variant.This botnets typically scan and attack vulnerable servers and install malware. I would venture to say you might be losing the connection because your firewall or routers are receiving too many connections from it, and either some table is exhausted, or they have DDoS mitigation configurations, and block it temporary. I would deal with the server as compromised, and reinstall it.You might want to launch it in a protected network to study the behaviour, and use the opportunity to learn about security.Download and run maldetect, and/or an anti-virus to see if you find out the name of what you have got. Use sysdig or dtrace4linux to trace system calls, files accessed, and network, and assorted system activity.I will leave a related link. Could or could not be this, further investigation will tell you otherwise.http://blog.malwaremustdie.org/2014/11/china-elf-botnet-malware-infection.html I will leave you a few related links of the tools:Linux Malware detecthttps://www.rfxn.com/projects/linux-malware-detect/dtrace4linuxhttps://github.com/dtrace4linuxsysdighttp://www.sysdig.orgAs for procedures, that version of CentOS is already 2 years old, and had no updates for a year, if I am not wrong. Any kind of servers connected to the Internet have to be kept up updated, or this is bound to happen. I already had a network outage due to a similar occurrence.