It sounds like your machine was the hub of a botnet. I would talk to your ISP and ask them to block all access to those IP/port pairs at the edge of their network. Chances are high that those connections will never stop as they're probably being initiated by some kind of worm.
-- Marc
-----Original Message----- From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of Niels Przybilla Sent: Monday, July 11, 2005 8:53 AM To: 'CentOS mailing list' Subject: AW: [CentOS] Anything todo against massive connects
Hi,
Yes i had a compromised server where a ircd was running on these ports.
Now many clients try to connect, but the server has been replaced and no irc is running and a better firewall configuration.
Best regards
Niels
-----Ursprüngliche Nachricht----- Von: centos-bounces@centos.org [mailto:centos-bounces@centos.org] Im Auftrag von Marco Garza Gesendet: Montag, 11. Juli 2005 15:47 An: CentOS mailing list Betreff: Re: [CentOS] Anything todo against massive connects
Niels Przybilla wrote:
Hi,
i got a server that is massivly contacted on the ports 5190, 5150 and 6667.
Is there any possibility to stop these requests ?
I block everything with my firewall.
That are ten thousands of different IP's that try to connect.
Thanks and best regards
Niels
CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.8.12/46 - Release Date: 7/11/2005
5190 is for AOL / AIM 6667 is IRC dcc I am not sure what 5150 is for.
Do you have servers behind this server??
-Marco Garza
CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
Gesendet von Yahoo! Mail - Jetzt mit 1GB Speicher kostenlos - Hier anmelden: http://mail.yahoo.de _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
-
Marc Powell