server problems- strange portsa nd processes

[edgar <edgar@monteparadiso.hr>]

Hello.
After changing some settings for a domain in Apache it couldn't be
started again. The error message said:

"Starting web server: Apache2(98)Address already in use: make_sock:
could not bind to address 0.0.0.0:8056
no listening sockets available, shutting down
Unable to open logs

We couldn't find any problems and we rebooted the machine. Then Apache
worked fine. But, after changing again some settings in apache and
restarting the web server we had the same problem.

Then we went to see what's on that port:
netstat -lnp | grep '0.0.0.0:8056'

and the result was:

tcp        0      0 0.0.0.0:8056            0.0.0.0:*
LISTEN     13337/flood

What was that flood? After killing the process apache worked fine.
A few days ago there were some problems on the server. we couldn't ssh
to it, the network card was in promiscous mode (it seems it was
attacked). Could it be that somone cracked it? The logs are clean.
It's a Debian Sarge with a 2.4.27-2-686 generic kernel image.