We've just been reported by someone after they noticed what looks like a DoS attack upon them from one of our servers. We're investigating, and will probably get a professional involved, but I'm curious - what's the best way to track down such an issue?
The server load is incredibly low (as always) and our bw stats show nothing unusual during the timeframe in question.
(I have the destination IP & port of the server we were presumably attacking if that helps)
Edit: I should probably mention we're running RHE on this one.
