Bizarre connections from and to a FC7 unattended

[Thomas TS]

stan wrote:
> It is possible, depending on how you are logging the TCP packets
> that you are seeing failed attempts rather than actual connections.  
>   
...
> Then run it with the fresh copy to see if it finds any infestations.
> Not perfect, but should catch crackers that aren't skilled.
>   
This is a brand new install.
Never was exposed to the Internet directly, always behind a NAT.

Yum auto-update is running and working fine.

What i can not accept is a huge UPload from this system to one of those 
suspect IPs, from a process not started by me !!!