Can Linux get malware? Linux machine causing lag spikes when plugged into network

zolly

Executive Member
Joined
Sep 1, 2005
Messages
5,919
Ok, here's the problem:

I play a lot of games, and I noticed about a week or two back that my ping had become very erratic (jumping between 170 and 300 in LoL, where it's normally a flat 170). I assumed it was because of my bro running torrents, so I went to his laptop (which runs Linux) and turned them off. Funny thing is, my ping kept on spiking. So I did the usual checks, and I thought maybe there's something still going on on his machine, so I unplugged it from the network. Guess what happens? My ping returns to a flat 170.

He has some kind of network monitoring tool open, so I go back, plug his machine in and see what happens. After a few minutes I see an error about failing to connect to the FTP for his OS. So I assume that's what's causing the spikes. His OS is trying to get updates but is failing to do so. I tell him about this when he gets back home and he tells me he'll fix it.

Now apparently he's fixed it, but guess what? Whenever his machine is plugged into the network, I still get ping spikes like his machine is uploading something to the internet. If it was a Windows machine, I'd say he picked something up from a porn site. Now I don't know much about Linux, so I was wondering if there's some kind of malware on his machine? I can't test it now, but tomorrow I'm going to connect his laptop to the network using wireless and see what happens.

I was just wondering if anyone had any suggestions on what I should be looking for.
 

Tinuva

The Magician
Joined
Feb 10, 2005
Messages
12,495
A good start, when his laptop is turned on, check what connections are open, eg as root: 'netstat -nptu' that will show you open tcp/udp connections as well as process id so that you can find out what process it is.

Furthermore, you can also install iftop and nethogs. Iftop will show traffic per connection. nethogs will show traffic per process.

Lastly, tcpdump is your friend to see the actual flow of traffic.

ps. You get just as much malware on Linux as windows, usually though you only find this on hacked webservers ect, but not impossible that your bro installed it.
 

Rickster

EVGA Fanatic
Joined
Jul 31, 2012
Messages
20,459
Request /move to the Linux section.

Posting your ISP and package will help a lot.
 

zolly

Executive Member
Joined
Sep 1, 2005
Messages
5,919
I'm with Openweb on one of their Silver packages, but I doubt it's ISP related. Every single time I start getting ping spikes I go and unplug his machine and within a few seconds my ping stabilises.

Thanks for the info Tinuva. I'll give those programs a try.
 

w1z4rd

Karmic Sangoma
Joined
Jan 17, 2005
Messages
49,748
Request /move to the Linux section.

Posting your ISP and package will help a lot.

Not in this case.

I'm with Openweb on one of their Silver packages, but I doubt it's ISP related. Every single time I start getting ping spikes I go and unplug his machine and within a few seconds my ping stabilises.

Thanks for the info Tinuva. I'll give those programs a try.

Are you sure he is not running a service or doing something naughty like using ettercap on your network?
 

zolly

Executive Member
Joined
Sep 1, 2005
Messages
5,919
Not in this case.



Are you sure he is not running a service or doing something naughty like using ettercap on your network?

I have no idea what ettercap is... I'm not sure about what he's up to. When I told him last night that it's starting to piss me off he just kind of shrugged it off, so I plan to see exactly what's going on this afternoon when I get back from work.
 

zolly

Executive Member
Joined
Sep 1, 2005
Messages
5,919
Also, I'm not sure offhand what package he's running... I think it's Fedora or Debian but I'll check it when I get home this afternoon.
 
Top