Date: Wed, 14 Apr 2010 16:01:54 -0700 From: Chuck Swiger <cswiger@mac.com> To: Steve Franks <bahamasfranks@gmail.com> Cc: FreeBSD Mailing List <freebsd-questions@freebsd.org> Subject: Re: hacked? Message-ID: <FA883213-E95E-43B2-815D-17094128ABD0@mac.com> In-Reply-To: <x2k539c60b91004141556u10ba49bfsd11cc069e5ef791f@mail.gmail.com> References: <x2k539c60b91004141556u10ba49bfsd11cc069e5ef791f@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi-- On Apr 14, 2010, at 3:56 PM, Steve Franks wrote: > I don't have bsdstats or similar that I'm aware of installed, so this > smells bad: > > Firewall is showing repeated attempts from your FreeBSD machine to > connect to port 25 (standard SMTP mail port) on a server in Belgium. This > implies something on your system is trying to send mail out. > > [14/Apr/2010 15:11:09] DROP "SMTP Deny" packet from Local Area > Connection - LAN, proto:TCP, len:48, ip/port:192.168.1.38:17343 -> > 81.247.120.78:25, flags: SYN , seq:43473770 ack:0, win:65535, tcplen:0 > > IP-Whois searches for "81.247.120.78:25" show this IP address belongs to > a Belgian ISP: There's no end of reasons (aka forged spam) why a machine might try to mail out to a random IP. Taking a look at /var/log/maillog and your queue of undelivered mail would be informative... Regards, -- -Chuck
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?FA883213-E95E-43B2-815D-17094128ABD0>