Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was futzing around with DTrace on Mac OS X and found the following script that prints out information about connections being established:

$ cat script.d

printf("execname: %s\n", execname);
printf("pid: %d\n", pid);
printf("sockfd: %d\n",arg0);

socks = (struct sockaddr*)copyin(arg1, arg2);

hport = (uint_t)socks->sa_data[0];
lport = (uint_t)socks->sa_data[1];
hport <<= 8; 
port = hport + lport; 
printf("Port number: %d\n", port); printf("IP address: %d.%d.%d.%d\n",

I run it in one window:
$ sudo dtrace -s ./script.d

Then I ssh to another machine from another window. I get this output from my dtrace window:

CPU     ID                    FUNCTION:NAME
  0  18696                    connect:entry execname: ssh
pid: 5446
sockfd: 3
Port number: 22
IP address:

  0  18696                    connect:entry execname: ssh
pid: 5446
sockfd: 5
Port number: 12148
IP address:


The first IP address I can explain (, that's the machine I'm connecting to. But what's with the machine? It doesn't show up in tcpdump nor netstat -an

Is there something with my dtrace code or my understanding of how the connect system call works?

share|improve this question

I think I've figured it out, it's the dtrace script which I grabbed from a Solarius site, needs to be changed for BSD.

share|improve this answer

Try doing a traceroute to that address and see where it is. If it's only a couple of hops away it's probably a firewall or switch.

share|improve this answer
12+ hops, can't ping it either. It's weird that it just shows up with ssh - but not safari, not ftp, not curl, etc. – user50799 Aug 10 '10 at 23:18

It's a vodaphone IP address in Italy. Are you connected to an ISP in Europe/Italy? If not, better start worrying.

share|improve this answer
Check this out, I did the same thing on a G5 with OSX 10.5.8, got the exact same results as on 10.6.4 on intel OSX. – user50799 Aug 10 '10 at 23:28

Port 12148 looks like a virus/Trojan issue - best to clean infected system asap

share|improve this answer

What does grep 'sshd.*from' secure.log say? If someone besides you has logged in via SSH then you have a problem. If they haven't it's likely an unsuccessful brute force attempt. Are you running DenyHosts or Fail2Ban?

I can't find any documentation on syscall::connect, but it looks like it's printing out both ends of the socket. What happens when you run the script and ssh in from another machine?

share|improve this answer
Just a bunch of crap. Doesn't look like it's been compromised. I'm running both emerging threats iptables firewall rules and denyhosts on the server. – user50799 Aug 11 '10 at 0:00
Apparently doesn't show incoming connections, just looks like outgoing connections. – user50799 Aug 11 '10 at 0:04

For what it is worth, this IP appears to be part of the network. Observe:

> host -a
Trying ""
Host not found: 3(NXDOMAIN)
Received 116 bytes from in 180 ms
> host -a
Trying ""
Received 112 bytes from in 388 ms
Trying ""
Host not found: 3(NXDOMAIN)
Received 139 bytes from in 859 ms
> host -a
Trying ""
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20054
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0


;; ANSWER SECTION: 28800 IN SOA 9 10800 3600 2592000 900 28800 IN NS 28800 IN NS

Received 148 bytes from in 373 ms
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.