Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When I run netstat -a, a lot of connections to foreign hosts show up. It's connected to a whole subnet, ie 123.123.123.x to the port 80. How can I see what is actually going on? My server doesn't look compromised. It's running ArchLinux.

share|improve this question
2  
Post the output of your that netstat command. Without that, it's quite difficult for us to tell you what's going on. –  EEAA Nov 3 '10 at 16:17

1 Answer 1

up vote 1 down vote accepted

netstat has a -p option that shows you which program is making the connection

$ wget http://serverfault.com &
$ netstat -ap
...
Proto Recv-Q Send-Q Local Address           Foreign Address         State       ID/Program
tcp        0      0 rgb.example.com:1034    stackoverflow.com:http  ESTABLISHED 2578/wget

You can then use ps to find out what user is running that process, what it's parent process is and other useful info.

You could use tcpdump dst net 123.123.123 to see what data is being sent and received.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.