[firewall]

hi, Deep u have a nice config. ! btw Server load is nothing to do with Zombie. As Zombies are already dead... they dont have much to do with server loadd.

now on the reason of that.. well i think i cant say anything on that by not seeing the server...
Btw you ca nchec kthe mySQL.. coz thwere is a latest exploits is released.

A .diff file, applied to the MySQL 5.0.0-alpha source distribution will allow building a MySQL client that can be used to connect to a remote MySQL server with no password.

This could be a reason.. some one may applying this.... as mySQL AB hasn't released a patch you may try to close the remote port to get rid of that...

btw here is that exploit code....

1941,1956c1941,1942
<   if (passwd[0])
<   {
<     if (mysql->server_capabilities & CLIENT_SECURE_CONNECTION)
<     {
<       *end++= SCRAMBLE_LENGTH;
<       scramble(end, mysql->scramble, passwd);
<       end+= SCRAMBLE_LENGTH;
<     }
<     else
<     {
<       scramble_323(end, mysql->scramble, passwd);
<       end+= SCRAMBLE_LENGTH_323 + 1;
<     }
<   }
<   else
<     *end++= '\0';                               /* empty password */
---
>   sprintf(end,"\x14\x00");
>   end+=2;