I had turned ssh on a while ago to do some remote work. I was just looking over some netstat info when I noticed someone had established an ssh session with me D: I turned ssh off immediately and looked up the address.
Netstat said the ssh session was "established". I'm assuming that means they know my password, and I'm going to change it either way, but I want to know if they definitely know my password. I assume my computer's been leaking because there were 68 packets in my Send-Q; I don't know exactly what that is, but I don't like the "Send" bit.
Am I ok if I just wipe my computer and put all my data back on it? I don't do anything important, and I don't connect to any networks that might have sensitive research material or keep much banking or personal information on there. Should I "nuke it from orbit", or is that overkill? If it isn't, how would I go about doing it?