Router Receive Light keep Flashing?

[weifan]

Hi,

I have a small Lan with SpeedStream Router. Last week, all computer couldn't access to internet and I found out that my linux box caused the problem. It took all bandwidth of my internet traffic. The receive light (LANR) kept flashing until I unpluged the linux box. I also found out if I killed two running processes from my linux, it would remove the problem. These two processes were ./baliza and ./listen.

However, the same problem occured this morning and I couldn't find these two processes when I typed "ps x". I tried to kill all the running processes I could, but the problem still existed. There were several processes I couldn't kill, [keventd], [kamp-idled], [kswapd], [kreclaimd], [bdflush], [kupdated].

Can someone show me where could be the problem this time?

TIA

Roger

 

[RhythmAce]

Could it be a bad NIC?

 

[Deleted]

Or a bad router/modem.

I'm not sure about the router but Speed Stream modems suck.

M. Brooks
X Concepts LLC

http://xconcepts.com

 

[weifan]

Afetr unpluging the linux box, all other computer can access the internet without any problem. Therefore, I think the router is OK.

Bad NIC? My linux can access internet although the LANR keep flashing.

Anything else I should try?

Thank you for your reply!

Roger

 

[rburke]

Well if you were hacked once, then it is totally possible that hte hacker learned from the first time you found them and installed a root kit to prevent you from "seeing" the processes. What kind of services do you run on this box? Have you run all the updates? What dist. did you use? You can try running the command "netstat -alp" and see if you see any open ports or processes opening ports that look suspicious. But personally once you've been hacked the best thing to do is clean sweep the system by reformatting and reinstalling. Then just mark it up as a learning experience.

If it were a bad NIC then there would probably be other symptoms. What kind of switch are you using? Is it a managed, or an unmanaged one? If it is managed then the interface on the switch should show errors if it is a NIC going out. And hell, just to save yourself the trouble you can try swapping out NICs and if it still occurs then I would reformat and chalk it up as a learning experience.

Any ways, keep us up to date.

Burke

 

[weifan]

I put a new NIC and so far no problem seen.

Thanks!

Roger