[lug] phantom irc traffic

[Patrick Mullen]

> Somebody noticed a very regular pattern of IRC traffic from our webserver.
> Every 3 minutes a handshake.

You say "handshake."  Is the connection successful?  If the server
isn't listening, I'd set up a static route to redirect traffic to a
server under my control to see what it's trying to do.  Namely, what
channel(s) it joins and what messages are sent.

I find it interesting that you can't find the process that is
attempting the connections.  Add to that the regular intervals, and
I'd try to profile the behavior to know what you need to clean.


~Patrick