How to identify if the server was hacked or not?

Question

linux

Hello. Recently, I noticed excessive activity on the network on my server, although I have many services installed, but there should not have been any activity, since ip, like the domain, I almost didn’t shine anywhere,
tell me how to fully monitor the network in linux debian 10?
And how can you detect a hack if there is one?

Answer 1

Here, in theory, there should be a Barmin patch :) But it won’t, because it will actually use it :)

Answer 2

although I have many services installed .... tell me how to fully monitor the network in linux debian 10

We got into the car, pressed the gas, but you don’t know how to steer and slow down?)))
Geolocation of IP addresses
Show the network traffic and IPv4/IPv6 hosts
Analyze the traffic and sort it according to the source/destination
Store traffic statistics in RRD format
Report and sort IP protocol usage by protocol type

Answer 3

Traffic? Look at least at /var/log/auth.log, some services add authorization events there, including attempts to crack / guess a password. Maybe just network scanners are hammering you, trying to break through, that's the traffic ...
Find out if they've been hacked? You can check the binaries of installed programs with the debsums utility in case they are modified. Antivirus programs for UNIX-like also exist, you can use it.