It sounds like your machine was the hub of a botnet. I would talk to your ISP
and ask them to block all access to those IP/port pairs at the edge of their
network. Chances are high that those connections will never stop as they're
probably being initiated by some kind of worm.
--
Marc
> -----Original Message-----
> From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On
> Behalf Of Niels Przybilla
> Sent: Monday, July 11, 2005 8:53 AM
> To: 'CentOS mailing list'
> Subject: AW: [CentOS] Anything todo against massive connects
>
> Hi,
>
> Yes i had a compromised server where a ircd was running on these ports.
>
> Now many clients try to connect, but the server has been replaced and no
> irc
> is running and a better firewall configuration.
>
> Best regards
>
> Niels
>
> -----Urspr?ngliche Nachricht-----
> Von: centos-bounces at centos.org [mailto:centos-bounces at centos.org] Im
> Auftrag
> von Marco Garza
> Gesendet: Montag, 11. Juli 2005 15:47
> An: CentOS mailing list
> Betreff: Re: [CentOS] Anything todo against massive connects
>
> Niels Przybilla wrote:
> >> Hi,
> >>
> >> i got a server that is massivly contacted on the ports 5190, 5150
and
> >> 6667.
> >>
> >> Is there any possibility to stop these requests ?
> >>
> >> I block everything with my firewall.
> >>
> >> That are ten thousands of different IP's that try to connect.
> >>
> >> Thanks and best regards
> >>
> >> Niels
> >>
> >
> >
> >
> >> _______________________________________________
> >> CentOS mailing list
> >> CentOS at centos.org
> >> http://lists.centos.org/mailman/listinfo/centos
> >>
> >
> >
> >
> > No virus found in this incoming message.
> > Checked by AVG Anti-Virus.
> > Version: 7.0.323 / Virus Database: 267.8.12/46 - Release Date:
> > 7/11/2005
>
> 5190 is for AOL / AIM
> 6667 is IRC dcc
> I am not sure what 5150 is for.
>
> Do you have servers behind this server??
>
> -Marco Garza
>
>
>
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
>
>
>
>
>
>
> ___________________________________________________________
> Gesendet von Yahoo! Mail - Jetzt mit 1GB Speicher kostenlos - Hier
> anmelden: http://mail.yahoo.de
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos