Cpu usage - too many connection to port 53

[majidA]

I have high cpu usage load for httpd and named.
i checked netstat by these commands and found too many connection with Time_Wait status:

1)# netstat -anp :

tcp 0 0 127.0.0.1:56268 127.0.0.1:53 TIME_WAIT -
tcp 0 0 127.0.0.1:56269 127.0.0.1:53 TIME_WAIT -
tcp 0 0 127.0.0.1:56266 127.0.0.1:53 TIME_WAIT -
tcp 0 0 127.0.0.1:56267 127.0.0.1:53 TIME_WAIT -
tcp 0 0 127.0.0.1:56265 127.0.0.1:53 TIME_WAIT -
tcp 0 0 127.0.0.1:56261 127.0.0.1:53 TIME_WAIT -
tcp 0 0 127.0.0.1:56280 127.0.0.1:53 TIME_WAIT -
tcp 0 0 127.0.0.1:56278 127.0.0.1:53 TIME_WAIT -


2) #netstat -tap
tcp 0 0 MyLocalHostName:56335 MyLocalHostName:domain TIME_WAIT -
tcp 0 0 MyLocalHostName:56334 MyLocalHostName:domain TIME_WAIT -
tcp 0 0 MyLocalHostName:56321 MyLocalHostName:domain TIME_WAIT -
tcp 0 0 MyLocalHostName:56320 MyLocalHostName:domain TIME_WAIT -
tcp 0 0 MyLocalHostName:56323 MyLocalHostName:domain TIME_WAIT -
tcp 0 0 MyLocalHostName:56322 MyLocalHostName:domain TIME_WAIT -
tcp 0 0 MyLocalHostName:56325 MyLocalHostName:domain TIME_WAIT -
tcp 0 0 MyLocalHostName:56324 MyLocalHostName:domain TIME_WAIT -
tcp 0 0 MyLocalHostName:56327 MyLocalHostName:domain TIME_WAIT -
tcp 0 0 MyLocalHostName:56326 MyLocalHostName:domain TIME_WAIT -

I check my named configuration and it's not an open dns. please help me to resolve this problem.

 

[IgorG]

Did you tried check your server with chkrootkit, for example? Maybe it is compromised?

 

[padani]

Friend,

Root kit or some other web or box exploit. Check the TEMP, dev/shm for suspicious hidden folders and files.

 

[majidA]

I checked fstab

I checked rootkit and all things are "ok"

this is my /etc/fstab:

LABEL=/ / ext3 defaults 1 1
LABEL=/var /var ext3 defaults 1 2
LABEL=/backup /backup ext3 defaults 1 2
LABEL=/tmp /tmp ext3 noexec,nosuid,loop 1 2
LABEL=/usr /usr ext3 defaults 1 2
LABEL=/boot /boot ext3 defaults 1 2
tmpfs /dev/shm tmpfs defaults 0 0
devpts /dev/pts devpts gid=5,mode=620 0 0
sysfs /sys sysfs defaults 0 0
proc /proc proc defaults 0 0
LABEL=SWAP-ddf1_HOST_ swap swap defaults 0 0


But I have high cpu load?

 

[majidA]

any body help me to find periodic high load named httpd mysql load?