connection request to port 25

[s.hashim () usa net (SHAIFUL HASHIM)]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
Hi all,

I believed one of the workstations in my university has been compromised. I've
monitored any connection from outside to the machine using snort. What I've
got are overwhelming connection request to port 25 with SYN bit set from
multiple of hosts. Currently the mail has not been used much but the log have
shown that the mail port is very active. Can you tell me what sort of attack
this might be and what is possibly going on?

Thanks
Shaiful
UKM

____________________________________________________________________
Get free email and a permanent address at http://www.netaddress.com/?N=1