stat running as www weirdness - genarting INCOMING traffic

[Chuck Swiger]

Ruben Bloemgarten wrote:
> I’m seeing weirdness of stat opening up port  4000+ and generating/receiving
> enormous amounts of incoming traffic i.e. 400Gb over a 24hour time
> period.Does this sound familiar to anyone ? Thanks for any brain usage not
> my own.

Insufficient data.  From which port(s) to which port(s), and are the IP 
addresses on the other side the same or a random range (which would imply your 
machine has been hacked and is scanning outwards).

Showing a tcpdump of a few example connections would be really useful.

-- 
-Chuck