首頁>Computer>source

我在家中的Raspberry Pi上執行有Pi-hole(v5.2.2 web介面v5.2.2 FTL v5.3.4),並且我已经配置了LAN以將其用於DNS需求.从前一段時間以来,我註意到我的計算機在没有明顯原因的情况下会顯示為脫機。

经過研究,我發現Synology 716 + II NAS(DSM版本:6.2.3-25426 Update 3)將向路由器(ASUS RT-AC88U)發送大量DNS查詢 將他们轉發到Pi孔.路由器的dnsmasq偶爾会阻止查詢,因為查詢速度太快.這似乎阻止了客戶端執行DNS探測,這就是為什麼我的計算機认為它们處於脫機狀態。

問题是,我的NAS每小時發送約5,000个有關不相關網頁的查詢.顯然,NAS受到某種恶意軟體的侵害,充当DNS服務器並响應查詢.我没有安裝Synology DNS服務器軟體包.我已经確定了IP,並通過在路由器級別上對其进行了阻止,似乎可以極大地减少NAS發送的查詢。

我已经尝試了所有方法,例如从路由器禁用UPnP,禁用所有埠轉發.在NAS上重新安裝DSM,但無济於事.我尚未格式化硬碟,只是執行了系統分區清理並重新安裝。

有關如何確定此問题的原因/應用的任何提示?

从SSH連線到NAS的tcpdump示例. 192.168.1.8 是NAS和 192.168.1.4 是Raspberry Pi:

ps waux命令的輸出:

root         1  0.0  0.0  24144  3292 ?        Ss    2020   1:02 /sbin/init
root         2  0.0  0.0      0     0 ?        S     2020   0:00 [kthreadd]
root         3  0.0  0.0      0     0 ?        S     2020   0:17 [ksoftirqd/0]
root         5  0.0  0.0      0     0 ?        S<    2020   0:00 [kworker/0:0H]
root         7  0.0  0.0      0     0 ?        S     2020   0:07 [migration/0]
root         8  0.0  0.0      0     0 ?        S     2020   0:00 [rcu_bh]
root         9  0.1  0.0      0     0 ?        S     2020   1:34 [rcu_sched]
root        10  0.0  0.0      0     0 ?        S     2020   0:00 [watchdog/0]
root        11  0.0  0.0      0     0 ?        S     2020   0:00 [watchdog/1]
root        12  0.0  0.0      0     0 ?        S     2020   0:09 [migration/1]
root        13  0.0  0.0      0     0 ?        S     2020   0:16 [ksoftirqd/1]
root        15  0.0  0.0      0     0 ?        S<    2020   0:00 [kworker/1:0H]
root        16  0.0  0.0      0     0 ?        S     2020   0:00 [watchdog/2]
root        17  0.0  0.0      0     0 ?        S     2020   0:01 [migration/2]
root        18  0.0  0.0      0     0 ?        S     2020   0:16 [ksoftirqd/2]
root        20  0.0  0.0      0     0 ?        S<    2020   0:00 [kworker/2:0H]
root        21  0.0  0.0      0     0 ?        S     2020   0:00 [watchdog/3]
root        22  0.0  0.0      0     0 ?        S     2020   0:02 [migration/3]
root        23  0.0  0.0      0     0 ?        S     2020   0:16 [ksoftirqd/3]
root        25  0.0  0.0      0     0 ?        S<    2020   0:00 [kworker/3:0H]
root        26  0.0  0.0      0     0 ?        S<    2020   0:00 [khelper]
root        27  0.0  0.0      0     0 ?        S     2020   0:00 [kdevtmpfs]
root        28  0.0  0.0      0     0 ?        S<    2020   0:00 [netns]
root       190  0.0  0.0      0     0 ?        S<    2020   0:00 [writeback]
root       194  0.0  0.0      0     0 ?        S<    2020   0:00 [kintegrityd]
root       195  0.0  0.0      0     0 ?        S<    2020   0:00 [bioset]
root       196  0.0  0.0      0     0 ?        S<    2020   0:00 [crypto]
root       198  0.0  0.0      0     0 ?        S<    2020   0:00 [kblockd]
root       312  0.0  0.0      0     0 ?        S<    2020   0:00 [ata_sff]
root       322  0.0  0.0      0     0 ?        S<    2020   0:00 [md]
root       467  0.0  0.0      0     0 ?        S<    2020   0:00 [rpciod]
root       532  0.0  0.0      0     0 ?        S     2020   0:00 [khungtaskd]
root       537  0.5  0.0      0     0 ?        S     2020   7:33 [kswapd0]
root       546  0.0  0.0      0     0 ?        SN    2020   0:00 [ksmd]
root       547  0.0  0.0      0     0 ?        S     2020   0:00 [fsnotify_mark]
root       552  0.0  0.0      0     0 ?        S<    2020   0:00 [nfsiod]
http      1133  0.0  0.5 463332 42780 ?        S     2020   0:27 php-fpm: pool www
root      1223  0.0  0.0      0     0 ?        S    12:05   0:00 [kworker/1:2]
http      1252  0.0  0.4 461804 39348 ?        S     2020   0:22 php-fpm: pool www
root      2327  0.0  0.1  36400 10740 ?        S<s   2020   0:00 nginx: master process /usr/bin/nginx -g pid /run/nginx.pid; daemon on; master_process on;
root      2472  0.0  0.0      0     0 ?        S    12:29   0:00 [kworker/u8:3]
root      2939  0.0  0.0      0     0 ?        S<    2020   0:00 [iscsi_eh]
root      2974  0.0  0.0      0     0 ?        S     2020   0:00 [scsi_eh_0]
root      2991  0.0  0.0      0     0 ?        S     2020   0:00 [scsi_eh_1]
root      3034  0.0  0.0      0     0 ?        S    12:40   0:00 [kworker/2:0]
root      3072  0.0  0.0      0     0 ?        S    12:41   0:00 [kworker/u8:0]
root      3096  0.0  0.0      0     0 ?        S     2020   0:00 [scsi_eh_2]
http      3186  0.0  0.0  99636  2300 ?        S     2020   0:00 /var/packages/Apache2.4/target/usr/local/bin/httpd24
http      3190  0.0  0.0 2412032 5160 ?        Sl    2020   0:00 /var/packages/Apache2.4/target/usr/local/bin/httpd24
root      3244  0.0  0.0      0     0 ?        S<    2020   0:00 [raid5wq]
root      3289  0.0  0.0      0     0 ?        S<    2020   0:00 [deferwq]
root      3409  0.0  0.0      0     0 ?        S     2020   0:00 [khubd]
root      3414  0.0  0.0      0     0 ?        S     2020   0:00 [kethubd]
root      3585  0.0  0.0      0     0 ?        S<    2020   0:00 [etxhci_wq3]
root      3636  0.0  0.0      0     0 ?        S<    2020   0:04 [kworker/2:1H]
root      3637  0.0  0.0      0     0 ?        S<    2020   0:05 [kworker/3:1H]
root      3640  0.0  0.0      0     0 ?        S<    2020   0:00 [bioset]
root      3641  0.0  0.0      0     0 ?        S     2020   0:02 [md0_raid1]
root      3642  0.0  0.0      0     0 ?        S<    2020   0:05 [kworker/0:1H]
root      3643  0.0  0.0      0     0 ?        S<    2020   0:05 [kworker/1:1H]
root      3668  0.0  0.0      0     0 ?        S<    2020   0:00 [bioset]
root      3669  0.0  0.0      0     0 ?        S     2020   0:00 [md1_raid1]
root      3750  0.0  0.0      0     0 ?        S    12:53   0:00 [kworker/0:1]
root      3805  2.7  0.2 452484 18244 ?        S    01:44  19:11 /usr/bin/smbd -F
root      3856  0.0  0.0      0     0 ?        S<    2020   0:00 [ext4-group-desc]
root      3857  0.0  0.0      0     0 ?        S     2020   0:02 [jbd2/md0-8]
root      3858  0.0  0.0      0     0 ?        S<    2020   0:00 [ext4-dio-unwrit]
root      3901  0.0  0.0  17276   792 ?        Ss    2020   0:00 /usr/bin/cgmanager --sigstop
system    3982  0.2  0.1 1240188 9068 ?        Ssl   2020   3:07 /usr/bin/syslog-ng -F --worker-threads=4 -u system -g log
root      4291  0.0  0.0      0     0 ?        S    13:03   0:00 [kworker/u8:1]
root      4346  0.0  0.0      0     0 ?        S    13:04   0:00 [kworker/2:1]
root      4397  0.0  0.0      0     0 ?        S    13:05   0:00 [kworker/0:0]
root      4402  0.0  0.0      0     0 ?        S    13:05   0:00 [kworker/u8:2]
root      4430  0.0  0.0      0     0 ?        S<    2020   0:00 [ipv6_addrconf]
root      4498  0.0  0.0      0     0 ?        S    13:07   0:00 [kworker/u8:4]
root      4577  0.0  0.0      0     0 ?        S    13:08   0:00 [kworker/2:3]
root      4593  0.0  0.0  76140  2816 ?        Ss    2020   0:01 /usr/syno/sbin/synologaccd -f
root      4609  0.0  0.0  81568  2076 ?        SNs   2020   0:00 /usr/syno/bin/synologrotated
root      4615  0.0  0.0      0     0 ?        S    13:09   0:00 [kworker/3:2]
root      4617  0.0  0.0  13124  1200 ?        Ss    2020   0:04 /sbin/dbus-daemon --session --fork --print-address
root      4648  0.0  0.0      0     0 ?        S    13:10   0:00 [kworker/0:3]
root      4657  0.0  0.0      0     0 ?        S    13:10   0:00 [kworker/1:0]
root      4661  0.5  0.1 213004  9968 ?        Ss   13:10   0:00 sshd: [email protected]/14
root      4669  0.4  0.0 199800  7812 pts/14   Ss   13:10   0:00 sudo -i
root      4672  0.0  0.0  26140  2328 pts/14   S    13:10   0:00 -ash
root      4703  0.0  0.0  27740  1464 pts/14   R+   13:10   0:00 ps waux
root      4707  0.0  0.0  13124   880 ?        Ss    2020   0:00 /sbin/dbus-daemon --system --nopidfile
root      4800  0.0  0.0 326104  4552 ?        Ssl   2020   0:00 /usr/syno/sbin/synoconfd -D
root      4822  0.0  0.0 311484  3672 ?        Ssl   2020   0:02 /usr/syno/sbin/synonetd
root      4850  0.0  0.0      0     0 ?        S     2020   0:00 [ecryptfs-kthrea]
root      5251  0.0  0.0  18024  1304 ?        Ss    2020   0:00 udevd --daemon
http      5320  1.9  0.5 802180 44704 ?        Ssl   2020  23:48 [stealth]
root      5770  0.6  0.0      0     0 ?        Z    04:33   3:33 [synoavscan] <defunct>
root      5903  0.0  0.0      0     0 ?        S<    2020   0:00 [bioset]
root      6505  0.0  0.0      0     0 ?        S<   03:55   0:00 [kworker/u9:0]
root      7116  0.0  0.0   8512  1900 ?        Ss    2020   0:00 /usr/sbin/dhclient -4 -d -q -lf /tmp/dhcpv4.leases.eth1 -pf /tmp/dhcpcd-eth1.pid -sf /var/run/dh
root      7204  0.0  0.0      0     0 ?        S<    2020   0:00 [bioset]
root      7208  0.0  0.0      0     0 ?        S     2020   0:04 [md2_raid1]
root      7505  0.0  0.0   8516  1932 ?        Ss    2020   0:00 /usr/sbin/dhclient -4 -d -q -lf /tmp/dhcpv4.leases.eth0 -pf /tmp/dhcpcd-eth0.pid -sf /var/run/dh
root      7784  0.0  0.0      0     0 ?        Z<s  04:36   0:00 [SYNO.Core.Deskt] <defunct>
system    7804  0.0  0.0 262852    72 ?        S    04:36   0:00 synoscgi
root      7853  0.0  0.0      0     0 ?        Z<s  04:36   0:00 [SYNO.Core.Packa] <defunct>
root      8047  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-worker]
root      8049  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-worker-hi]
root      8050  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-delalloc]
root      8051  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-flush_del]
root      8052  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-flush_met]
root      8053  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-cache]
root      8054  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-submit]
root      8055  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-fixup]
root      8056  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-endio]
root      8057  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-endio-met]
root      8059  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-endio-met]
root      8060  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-endio-rai]
root      8061  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-rmw]
root      8062  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-endio-wri]
root      8063  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-freespace]
root      8064  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-delayed-m]
root      8065  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-readahead]
root      8067  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-qgroup-re]
root      8068  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-usrquota-]
root      8069  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-extent-re]
root      8070  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-syno_noco]
root      8072  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-syno_high]
root      8120  0.0  0.0      0     0 ?        S     2020   0:00 [btrfs-cleaner]
root      8121  0.0  0.0      0     0 ?        S     2020   0:09 [btrfs-transacti]
root      8510  0.0  0.0 295464  3616 ?        Ssl   2020   0:00 /usr/syno/sbin/synologand
root      8529  0.0  0.0 117404  2380 ?        Ss    2020   0:00 /usr/syno/sbin/synocrond
root      8677  0.0  0.0 147788  1816 ?        Ss    2020   0:00 synostoraged
root      8683  0.0  0.0 147788  2140 ?        S     2020   0:03 /usr/syno/sbin/synostoraged
root      8684  0.0  0.0 147788  2824 ?        S     2020   0:20 /usr/syno/sbin/synostoraged
root      8685  0.0  0.0 147788  2880 ?        S     2020   0:14 /usr/syno/sbin/synostoraged
root      8820  0.0  0.0 171536  3612 ?        Ss    2020   0:01 /usr/syno/bin/s2s_daemon -d
root      9002  0.0  0.0      0     0 ?        S     2020   0:00 [scsi_eh_3]
root      9003  0.0  0.0      0     0 ?        S     2020   0:00 [usb-storage]
root      9177  0.0  0.0  73300  1696 ?        Ss    2020   0:01 /usr/syno/bin/synobackupd
root      9278  0.0  0.0 151976  3116 ?        Ss    2020   0:11 /usr/syno/sbin/hotplugd
root      9467  0.1  0.1 265900  8932 ?        Ss    2020   2:19 /usr/bin/snmpd -fLn -c /etc/snmp/snmpd.conf -p /var/run/snmpd.pid 127.0.0.1:161
root      9604  0.0  0.0  96888  3260 ?        Ss    2020   0:00 /usr/syno/sbin/synoagentregisterd
root      9617  0.0  0.0 262852  1544 ?        S<s   2020   0:23 synoscgi
root      9621  0.0  0.1 348628  8116 ?        Ss   02:10   0:03 /usr/bin/nmbd -F
root      9634  0.0  0.0 155928  4208 ?        S<s   2020   0:03 /usr/syno/sbin/synosnmpcd
root      9651  0.0  0.0 266272  3928 ?        S<s   2020   0:13 /usr/syno/sbin/synocgid -D
root      9659  0.0  0.0 130088  5724 ?        Ss    2020   0:01 /usr/syno/sbin/ddnsd
root      9664  0.0  0.0 127636  5736 ?        Ss    2020   0:02 /usr/syno/sbin/heartbeatd
root      9696  0.0  0.0  25124  1512 ?        S    02:10   0:01 avahi-daemon: running [DIMI-NAS.local]
http      9709  0.0  0.1  36404 11064 ?        S<   02:10   0:00 nginx: worker process
http      9710  0.0  0.1  36404 11328 ?        S<   02:10   0:00 nginx: worker process
http      9711  0.0  0.1  36404 11396 ?        S<   02:10   0:02 nginx: worker process
http      9712  0.0  0.1  36404 11448 ?        S<   02:10   0:03 nginx: worker process
ntp       9758  0.0  0.0  96156  2132 ?        Ssl   2020   0:03 /usr/sbin/ntpd -p /var/run/ntpd.pid -g -u ntp:ntp
root      9759  0.0  0.0 199800  3588 ?        Ss    2020   0:00 sudo -u nobody /usr/syno/bin/synowstransferd
root      9761  0.0  0.0 227128  2420 ?        S<s   2020   0:00 /usr/syno/bin/findhostd
root      9765  0.0  0.0      0     0 ?        Z<s  04:37   0:00 [SYNO.Entry.Requ] <defunct>
root      9809  0.0  0.0 174300  2876 ?        S     2020   0:01 /usr/bin/netatalk
root      9838  0.0  0.0 148260  3824 ?        Ss    2020   0:00 /usr/bin/sshd
root      9898  0.0  0.0      0     0 ?        Z<s  04:37   0:00 [SYNO.Core.Packa] <defunct>
root      9899  0.0  0.0      0     0 ?        Z<s  04:37   0:00 [SYNO.Core.UserS] <defunct>
root      9939  0.0  0.0 240360  6160 ?        S     2020   0:01 /usr/bin/afpd -d -F /etc/afp.conf
root      9940  0.0  0.0 150520  2812 ?        S     2020   0:00 /usr/bin/cnid_metad -d -F /etc/afp.conf
root      9960  0.0  0.0 199800  3584 ?        Ss    2020   0:00 sudo -u nobody /usr/syno/bin/synowsdiscoveryd
root      9974  0.0  0.0      0     0 ?        S     2020   0:01 [Syno_HDDMon]
nobody   10000  0.0  0.0  70064  1600 ?        S     2020   0:00 /usr/syno/bin/synowstransferd
root     10028  0.0  0.1 319336  9112 ?        SNsl  2020   0:02 /usr/syno/sbin/synocontentextractd
root     10048  0.0  0.0   6248  2340 ?        SLs   2020   0:00 /usr/bin/vmtouch -lfd /var/run
root     10055  0.0  0.0   8584   700 ttyS0    Ss+   2020   0:00 /sbin/getty 115200 console
nobody   10062  0.1  0.1 244072 12812 ?        Sl    2020   1:56 /bin/python2 /usr/syno/bin/synowsdiscoveryd
root     10150  0.0  0.0      0     0 ?        S     2020   0:00 [RODSP_ODX_LOGIN]
root     10151  0.0  0.0      0     0 ?        S     2020   0:00 [RODSP_VLUN_LOGI]
root     10152  0.0  0.0      0     0 ?        S     2020   0:00 [RODSP_VDISK_LOG]
system   10201  0.0  0.0 262852    72 ?        S    04:37   0:00 synoscgi
postgres 10217  0.0  0.4 574888 33104 ?        Ss    2020   0:00 /usr/bin/postgres -D /var/services/pgsql
root     10282  0.0  0.1 424688 11408 ?        Ss    2020   0:01 /usr/bin/smbd -F
root     10427  0.0  0.0 325584  1020 ?        Ssl  03:56   0:00 /var/packages/AntiVirus/target/bin/synoavd
postgres 10435  0.0  0.0 575148   884 ?        Ss    2020   0:00 postgres: checkpointer process
postgres 10436  0.0  0.0 575148  4056 ?        Ss    2020   0:00 postgres: writer process
postgres 10437  0.0  0.0 575148   884 ?        Ss    2020   0:00 postgres: wal writer process
root     10451  0.0  0.0 245604  2756 ?        SNs   2020   0:00 /usr/syno/sbin/synocontentextractd
root     10452  0.0  0.0 245604  2760 ?        SNs   2020   0:00 /usr/syno/sbin/synocontentextractd
system   10465  0.0  0.0 262852    80 ?        S    03:56   0:00 synoscgi
root     10543  0.0  0.0      0     0 ?        S<    2020   0:00 [cifsiod]
root     10546  0.0  0.0      0     0 ?        S<    2020   0:00 [cifsoplockd]
root     10659  0.0  0.0 498400  5572 ?        S     2020   0:08 /usr/bin/smbd -F
root     10661  0.0  0.0 424660  4004 ?        S     2020   0:00 /usr/bin/smbd -F
root     10763  0.0  0.0  68868  1236 ?        SNs   2020   0:00 /usr/syno/sbin/synoindexd
root     10787  0.0  0.1 448184 10336 ?        S     2020   0:11 /usr/bin/smbd -F
root     11013  0.0  0.0   7224  1132 ?        Ss    2020   0:00 /usr/sbin/crond
root     11015  0.0  0.0 141424  3192 ?        Ss    2020   0:00 /usr/syno/bin/synodisklatencyd
root     11060  0.2  0.0 750384  4336 ?        Ssl   2020   2:58 /usr/syno/bin/scemd
root     11100  0.8  0.1 305424 11432 ?        SLl   2020  11:08 /usr/syno/sbin/synorelayd
root     11224  0.0  0.1 432312  8548 ?        Ss    2020   0:02 php-fpm: master process (/var/packages/WebStation/target/misc/php74_fpm.conf)
root     12363  0.0  0.0 520928  4200 ?        Ssl   2020   0:03 /var/packages/FileStation/target/sbin/thumbd
root     12368  0.0  0.0 447196  3676 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12369  0.0  0.0 447196  3680 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12785  0.0  0.0 603184  4592 ?        Ssl   2020   0:29 /var/packages/USBCopy/target/sbin/usb-copyd
root     12789  0.0  0.0  68888  1408 ?        SN    2020   0:00 /usr/syno/sbin/synoindexscand
root     12790  0.0  0.0  68868  1424 ?        SN    2020   0:00 /usr/syno/sbin/synoindexworkerd
root     12791  0.0  0.0  82276  2064 ?        SN    2020   0:00 /usr/syno/sbin/synoindexplugind
root     12792  0.0  0.0 117096  4060 ?        SN    2020   0:00 /usr/syno/sbin/synomediaparserd
root     12916  0.0  0.0 520928  3728 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12917  0.0  0.0 520928  3728 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12918  0.0  0.0 520928  3724 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12919  0.0  0.0 520928  3724 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12920  0.0  0.0 520928  3724 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12922  0.0  0.0 520928  3724 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12923  0.0  0.0 520928  3724 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12924  0.0  0.0 520928  3724 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
http     12970  0.0  0.0  14960   636 ?        Ss    2020   0:00 /var/packages/WebStation/target/usr/bin/multiwatch -f 4 -- /var/packages/WebStation/target/usr/b
http     12976  0.0  0.0   8420   332 ?        S     2020   0:00 /var/packages/WebStation/target/usr/bin/fcgiwrap
http     12977  0.0  0.0   8420   332 ?        S     2020   0:00 /var/packages/WebStation/target/usr/bin/fcgiwrap
http     12978  0.0  0.0   8420   332 ?        S     2020   0:00 /var/packages/WebStation/target/usr/bin/fcgiwrap
http     12979  0.0  0.0   8420   332 ?        S     2020   0:00 /var/packages/WebStation/target/usr/bin/fcgiwrap
root     13635  0.0  0.5 543588 42652 ?        Ssl   2020   0:10 /var/packages/SynoFinder/target/sbin/synoelasticd
root     13904  0.0  0.0 293060  2848 ?        SNsl  2020   0:00 /usr/syno/bin/iscsi_snapshot_comm_core -D
root     13907  0.0  0.0 145600  2872 ?        SNs   2020   0:00 /usr/syno/bin/iscsi_snapshot_server -D
root     13915  0.0  0.0 189332  5260 ?        Ssl   2020   0:03 /usr/syno/bin/scsi_plugin_server
root     13972  0.0  0.0   4232   372 ?        SLs  02:33   0:00 /bin/vmtouch -l /usr/syno/bin/synoschedtask /usr/syno/bin/synoschedtool /usr/syno/etc/scheduled_
root     14281  0.0  0.0  99636  6696 ?        Ss    2020   0:03 /var/packages/Apache2.4/target/usr/local/bin/httpd24
root     14914  0.0  0.0   4188   308 ?        Ss    2020   0:01 /usr/bin/minissdpd -i eth0 -i eth1
root     15049  0.0  0.0 457424  7680 ?        Ss    2020   0:01 php-fpm: master process (/usr/syno/etc/packages/WebStation/php_profile/6c71a6ba-110a-4a99-8333-0
http     15070  0.0  0.0 432312   948 ?        S     2020   0:00 php-fpm: pool www
http     15071  0.0  0.0 432312   948 ?        S     2020   0:00 php-fpm: pool www
http     15945  0.0  0.3 461332 29336 ?        S     2020   0:23 php-fpm: pool www
root     19984  9.8  0.4  61092 39096 pts/15   S+   04:22  51:54 grep --color=auto -rnw / -e nslookup
root     21568  0.0  0.0 293072   204 ?        S    04:23   0:00 synoscgi_SYNO.AntiVirus.Scan_1_start_full
root     21574 98.8 12.4 1846268 1005620 ?     RNs  04:23 521:44 /var/packages/AntiVirus/target/bin/synoavscan --all
root     21800  0.0  0.0      0     0 ?        S<    2020   0:00 [kworker/u9:1]
root     22917  0.0  0.0 213004  5140 ?        Ss   03:28   0:00 sshd: [email protected]/15
root     22939  0.0  0.0 199800  3588 pts/15   Ss   03:28   0:00 sudo -i
root     22941  0.0  0.0  26156  1732 pts/15   S    03:28   0:00 -ash
root     23090  0.3  0.4 2636340 38796 ?       Ssl   2020   4:46 /var/packages/CloudSync/target/sbin/syno-cloud-syncd /volume1/@cloudsync/config/daemon.conf
root     26067  0.0  0.0      0     0 ?        S    09:40   0:03 [kworker/0:2]
system   26818  0.0  0.0 262852    80 ?        S    00:56   0:00 synoscgi
system   26819  0.0  0.0 262852    80 ?        S    00:56   0:00 synoscgi
root     28727  0.0  0.0  11976  1436 ?        S     2020   0:00 /bin/sh /usr/local/mariadb10/bin/mysqld_safe --datadir=/var/packages/MariaDB10/target/mysql --pi
mysql    28863  0.0  0.6 1781284 54596 ?       Sl    2020   0:30 /usr/local/mariadb10/bin/mysqld --basedir=/usr/local/mariadb10 --datadir=/var/packages/MariaDB10
root     29521  0.0  0.0      0     0 ?        S    10:45   0:01 [kworker/3:1]
root     30333  0.0  0.0      0     0 ?        S    11:01   0:01 [kworker/3:0]
root     30377  0.0  0.0      0     0 ?        S    11:02   0:01 [kworker/1:1]
root     32190  0.0  0.0      0     0 ?        S    11:37   0:01 [kworker/2:2]

使用Tonny的建議进行的更多研究:

udp        0      0 DIMI-NAS:56353          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:48653          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:53011          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:53159          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:53203          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:53288          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:53474          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:37553          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:42539          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:35339          pihole:domain           ESTABLISHED
最新回復
  • 5月前
    1 #

    問题已经解決。

    正如@Tonny在評論中指出的那樣,我在NAS的web站點上執行的唯一wordpress網頁確實存在漏洞.顯然,该網頁的所有者安裝了一些破解的插件,其中包括恶意代碼,並允许HTTP請求在後台執行令人讨厌的事情.我删除了連線到该網頁的虛擬主機,現在大約24小時没有出現此問题。

  • virtual machine:我如何在windows 10上使用kali linux(wsl2)和android(bluestacks)
  • Testing multicast:測試多播-無法获得正確的結果