Strange foreign connections

[Ruben de Groot]

On Wed, Feb 02, 2005 at 11:01:42AM -0600, Gene typed:
> While running netstat I found these entries:
> 
> Active Internet connections (including servers)
> Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)
> tcp4       0      0  localhost.52730        undernet1.blueyo.ircd   
> ESTABLISHED
> tcp4       0      0  localhost.52398        minotor.spale.co.ircd    
> ESTABLISHED
> tcp4       0      0  localhost.60635        bagan2.srce.hr.ircd       
> ESTABLISHED
> 
> 
>  The foreign addresses all show ircd at the end,  but there is no irc 
> clients or servers running and irc ports are blocked at the firewall.
> Does anyone have any idea what might be going on here?

I would assume your system is compromised, unless proven otherwise.

Ruben