CentOS 5 Server :: Tracing An Attack With A Wireshark Script

My data center informed me that my shared web hosting server is producing a massive attack. Attack against who? how? etc?... well.. other than "your server is generating an attack of over 150,000 UDP connections", they did not specify the target IP, nor the specific port. The attacks usually run for less than 5 minutes and pose a threat on the datacenter's firewall itself (from within).

I ran various searches on my server and came up with nothing. (over 300 websites with PHP in 25GB of data, database etc).

I do not allow any shell/bash other than myself, so no other logins are available. (I re-checked /etc/passwd for any bash).

I believe that there is probably some php fsckopen call or something to that degree that responds to a call from an external server. To make it easier to diagnose the problem and then stopping it, I need your assistance developing a simple tracing tool, methodology.

I have wireshark installed on the server.

My thoughts on how to capture this attack (which occurs at random) is as follow:

1. run a service that greps and count the UDP connections currently on the server and does this every 60 seconds. ( a simple one minute cron is enough).

netstat -a |grep UDP -cw

2. Currently the output shows: 0 (zero).

3. I do run a DNS server that can be queried, so I expect to see some UDP calls every so often. However, this is probably going to occur at < 50 entries.

4 . run this logic if no high loads on the server.

If servers load is < 3.00
{
If ( netstat -a |grep UDP -cw ) > 50
{
./tshark > wireshark.hacker.trace<timestamp>.txt;
email me an alert that "hey wireshark was triggered";
sleep (15)
killall -9 tshark
}
}