DDOS finding

Use the command

tcpdump -n -i eth0/1/any |  then you will get the packets that connects to the device..

then go the server

 vzlist -a| grep"ip"

If you want further reference please check the link 

http://www.cyberciti.biz/tips/netstat-command-tutorial-examples.html

then block the ipholder..

done!