From owner-freebsd-questions@FreeBSD.ORG Wed Jun 8 03:27:57 2005 Return-Path: X-Original-To: questions@freebsd.org Delivered-To: freebsd-questions@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D581316A41C for ; Wed, 8 Jun 2005 03:27:57 +0000 (GMT) (envelope-from tshadwick@goinet.com) Received: from mail.goinet.com (mail.goinet.com [208.207.72.15]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8817343D49 for ; Wed, 8 Jun 2005 03:27:57 +0000 (GMT) (envelope-from tshadwick@goinet.com) Received: from mail.goinet.com (localhost.goinet.com [127.0.0.1]) by mail.goinet.com (8.13.1/8.13.1) with ESMTP id j583RiMW036733; Tue, 7 Jun 2005 22:27:44 -0500 (CDT) (envelope-from tshadwick@goinet.com) Received: from localhost (tshadwick@localhost) by mail.goinet.com (8.13.1/8.13.1/Submit) with ESMTP id j583RhHL036729; Tue, 7 Jun 2005 22:27:43 -0500 (CDT) (envelope-from tshadwick@goinet.com) X-Authentication-Warning: mail.goinet.com: tshadwick owned process doing -bs Date: Tue, 7 Jun 2005 22:27:43 -0500 (CDT) From: Tony Shadwick To: Bob Bomar In-Reply-To: <42A66509.4070709@ibsd.us> Message-ID: <20050607222655.B23064@mail.goinet.com> References: <59030.68.165.89.73.1118200333.squirrel@68.165.89.73> <42A66509.4070709@ibsd.us> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Virus-Scanned: ClamAV version 0.85.1, clamav-milter version 0.85 on mail.goinet.com X-Virus-Status: Clean Cc: kalin mintchev , questions@freebsd.org Subject: Re: ircd X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Jun 2005 03:27:57 -0000 I concur. You might also want to run chkrootkit (security/chkrootkit) to see if you've been "0wned" so to speak. On Tue, 7 Jun 2005, Bob Bomar wrote: > kalin mintchev wrote: > | > | hi all... > | > | i found this 2 lines in the netstat output on one of my machines. we are > | not running ircd and according to nmap ports 3483 and 2143 are closed... > | > | can somebody please explain?? thanks..... > | > | tcp4 0 0 server.3484 zagreb.hr.eu.und.ircd > | ESTABLISHED > | tcp4 0 0 server.2143 free.tyranz.com.ircd > | ESTABLISHED > > Are you running any kind of irc client? The output means: > > There are 2 connections, one on port 3484, and another on 2143 > connected to zagreb.hr.eu.und and free.tyranz.com on the port > for ircd, port 6667. > > Some trojens use irc channels for control, might look into that. > > -- > Bob Bomar > bob@bomar.us > http://www.bomar.us/~bob > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org" > ------------ Output from gpg ------------ > gpg: Signature made Tue Jun 7 22:24:55 2005 CDT using DSA key ID 3AED74AA > gpg: Can't check signature: public key not found > >