Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I run netstat -a, a lot of connections to foreign hosts show up. It's connected to a whole subnet, ie 123.123.123.x to the port 80. How can I see what is actually going on? My server doesn't look compromised. It's running ArchLinux.

share|improve this question
Post the output of your that netstat command. Without that, it's quite difficult for us to tell you what's going on. – EEAA Nov 3 '10 at 16:17
up vote 1 down vote accepted

netstat has a -p option that shows you which program is making the connection

$ wget &
$ netstat -ap
Proto Recv-Q Send-Q Local Address           Foreign Address         State       ID/Program
tcp        0      0  ESTABLISHED 2578/wget

You can then use ps to find out what user is running that process, what it's parent process is and other useful info.

You could use tcpdump dst net 123.123.123 to see what data is being sent and received.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.