What IP's or what info did you see when you use NETSTAT on your server ?
Use Cports or TCPView (both are free programs, use google).
or
You can verify it with following command:
# netstat -nr
type following command at shell:
# route add 00.00.00.0 gw 127.0.0.1 lo
(Where 00.00.00.0 is attacker IP).
or
# route -n
You can also use reject target
# route add -host IP-ADDRESS reject
# route add -host 00.00.00.0 reject
To confirm the null routing status, use ip command as follows:
# ip route get 64.1.2.3
Drop entire subnet 192.00.00.0/24:
# route add -net 192.00.00.0/24 gw 127.0.0.1 lo
You can also use ip command to null route network or ip, enter:
# ip route add blackhole 192.00.00.0/29
# route -n
Good LucK!