0

I have a number of SSH tunnels set up between our company's server (hosts website) and our customer's servers (hosts database). For all sites but one the connection is relatively stable however one site is persistently causing problems. I was checking to see if the connection was still there using the following command;

netsta -aN | grep 24011

And got this output;

tcp        0      0 127.0.0.1:24011         0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:24011         127.0.0.1:46183         ESTABLISHED
tcp        0      0 127.0.0.1:24011         127.0.0.1:46179         ESTABLISHED
tcp        0      0 127.0.0.1:24011         127.0.0.1:46182         ESTABLISHED
tcp        0      0 127.0.0.1:24011         127.0.0.1:45907         ESTABLISHED
tcp        0      0 127.0.0.1:24011         127.0.0.1:46181         ESTABLISHED
tcp6       0      0 ::1:24011               :::*                    LISTEN
tcp6       0      0 127.0.0.1:45907         127.0.0.1:24011         ESTABLISHED
tcp6       0      0 127.0.0.1:46179         127.0.0.1:24011         ESTABLISHED
tcp6       0      0 127.0.0.1:46183         127.0.0.1:24011         ESTABLISHED
tcp6       0      0 127.0.0.1:46181         127.0.0.1:24011         ESTABLISHED
tcp6       0      0 127.0.0.1:46182         127.0.0.1:24011         ESTABLISHED

Could someone explain exactly what is going on here as for any other connection when i netstat i get the following results;

tcp        0      0 127.0.0.1:24002         0.0.0.0:*               LISTEN
tcp6       0      0 ::1:24002               :::*                    LISTEN

Where all these connections coming from and are they possibly the reason for my connection not working.

Improve this question

1 Answer 1

Reset to default
2

They are coming from some process on your local system. Probably the application that you are trying to use.

They are likely a symptom of your connection not working, not the cause. Your application has tried to open multiple connections via the tunnel, and the connections haven't completely failed, so they show up as open.

To identify for sure which local process owns the connections, do an lsof -i (requires lsof :), or an ss -ltp (part of linux iproute suite, not helpful if you're not on linux).

Improve this answer
2
  • Thanks Dan. So its a symptom of the failed connection. Cant for the life of me figure out why the connection keeps dropping. The service is working on the customer's server and thought that given the port connection is listed on netstat that it was open but there must be some problem.
    – EamonnMcElroy
    Jun 5, 2015 at 16:40
  • To be clear, for the ssh client to accept the tunneled connections, it has to have successfully built an ssh connection to the other side. At least with openssh. So the ssh connection is at least partly working. I'd be looking on the client's machine to see what's happening to that traffic. Turn on debugging in the sshd logs, and use -vv on your local ssh command, for starters.
    – Dan Pritts
    Jun 5, 2015 at 19:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .