This is just an addition to my this article with some corrections needed if you use FreeBSD.
netstat command should look like
netstat -ntu -f inet| awk '{print $5}' | cut -d. -f1-4 | sort | uniq -c | sort -nr|more
And firewall IP blocking command should be
ipfw add deny all from xxx.xxx.xxx.xxx to any in
