pop3 logs

[turnersloane]

We've seen a ton of these in the last day:

messages:Mar 22 20:45:49 ns PAM_pwdb[12070]: authentication failure; (uid=0) -> root for vm-pop3d service
messages:Mar 22 20:45:49 ns PAM_pwdb[12071]: authentication failure; (uid=0) -> root for vm-pop3d service
messages:Mar 22 20:45:50 ns PAM_pwdb[12078]: authentication failure; (uid=0) -> root for vm-pop3d service
messages:Mar 22 20:45:51 ns PAM_pwdb[12080]: authentication failure; (uid=0) -> root for vm-pop3d service
messages:Mar 22 20:45:52 ns PAM_pwdb[12083]: authentication failure; (uid=0) -> root for vm-pop3d service
messages:Mar 22 20:45:52 ns PAM_pwdb[12085]: authentication failure; (uid=0) -> root for vm-pop3d service

Obviously a bot of some sort is behind this - but I'd like to be able to determine the IP address(es) and firewall 'em. Grepped all the logs to no avail, so where else can I look to try to find their IP's?

TIA,

 

[cml]

Any update about this??

--------
cml

 

[floyd]

You can do:

netstat -n | grep :110

to see what clients are trying to connect to port 110.

 

[cml]

thanks for your help