[PLUG] Mysterious connections

Paul Heinlein heinlein at madboa.com
Wed Mar 23 15:40:46 UTC 2005


On Wed, 23 Mar 2005, Michael Montagne wrote:

> I was doing a netstat -n on my server at work this morning and 
> noticed these two connections.  Seem awfully odd to me.  Should I be 
> worried? How can investigate further?
>
> tcp        0      0 10.10.10.100:55519      66.197.0.145:6667 ESTABLISHED
> tcp        0      0 10.10.10.100:36921      193.110.95.1:6667 ESTABLISHED

Unless you've got local users who use IRC regularly, yeah, I'd be 
worried. If you've got root on the box, you can try to figure out what 
they're up to using tcpdump or ethereal.

--Paul Heinlein <heinlein at madboa.com>



More information about the PLUG mailing list