I have several Linux (mostly Debian) servers running on a Proxmox platform. All of them connecting to Internet through an ADSL line, with only one public IP.
One of them is running OMD (open monitoring distribution) since longer than a year ago to monitor an EXTERNAL server (other network, monitored through that ADSL connecting to Internet.
Now I have received a message from the owners of the remote server saying that they have detected a port scan run in the night from my ADSL public IP scanning their open ports.
It's the second time this happens to me with a Debian system :(
I need to detect the process running that scan
- how can I find out what process is launching that portscan from the offending linux box? The difficulty here is that I'd need to run -whatever- to know the process when the scan takes place -which can happen at some moment in the night-.
- Is there a way to get a list of processes that have somehow being launched and then finished between two times (i.e. new processes started from 23:00 to 03:00)
Thanks in advance