[PLUG] Mysterious connections
Paul Heinlein
heinlein at madboa.com
Wed Mar 23 15:40:46 UTC 2005
On Wed, 23 Mar 2005, Michael Montagne wrote:
> I was doing a netstat -n on my server at work this morning and
> noticed these two connections. Seem awfully odd to me. Should I be
> worried? How can investigate further?
>
> tcp 0 0 10.10.10.100:55519 66.197.0.145:6667 ESTABLISHED
> tcp 0 0 10.10.10.100:36921 193.110.95.1:6667 ESTABLISHED
Unless you've got local users who use IRC regularly, yeah, I'd be
worried. If you've got root on the box, you can try to figure out what
they're up to using tcpdump or ethereal.
--Paul Heinlein <heinlein at madboa.com>
More information about the PLUG
mailing list