Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've just stopped all pretty much all services except sshd on my server (Ubuntu Server 10.04), and when I run iftop I get output that looks like this:

                 12.5Kb            25.0Kb           37.5Kb            50.0Kb      62.5Kb
└────────────────┴─────────────────┴────────────────┴─────────────────┴─────────────────   <=>             1.75Kb  1.54Kb  2.22Kb <=>              536b    107b     27b <=>             0b    105b     26b <=>              0b    105b     26b <=>                0b     72b     18b <=>              0b      0b     49b <=>              0b      0b     29b <=>              0b      0b     26b <=>                0b      0b     26b <=>               0b      0b     26b <=>             0b      0b     26b <=>                0b      0b     25b <=>             0b      0b     25b <=>               0b      0b     25b <=>                0b      0b     25b <=>               0b      0b     18b <=>              0b      0b     18b <=>               0b      0b     18b <=>               0b      0b     17b
TX:             cumm:  61.6KB   peak:   8.00Kb          rates:   1.59Kb  1.38Kb  2.04Kb
RX:                    18.4KB           1.64Kb                    696b    549b    640b
TOTAL:                 80.0KB           9.64Kb                   2.27Kb  1.92Kb  2.66Kb

This is the first part (not the unix socket part) of the output of netstat -a:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 *:ssh                   *:*                     LISTEN
tcp        0      0 *:55677                 *:*                     LISTEN
tcp        0      0 flash.gateway.2wire:ssh      ESTABLISHED
tcp        0     48 flash.gateway.2wire:ssh      ESTABLISHED
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN
udp        0      0 *:37790                 *:*

What could all those strange connections on port 21095 be? And why would they not show up in netstat?? Any advice would be greatly appreciated.

share|improve this question
Is this server configured as a gateway (just guessing by the domainname) and uses IPTables to NAT, or something like that? So maybe tis is another host connecting through you. – Christopher Perrin Jul 8 '12 at 17:40
@ChristopherPerrin the hostname is "flash," the "" is a domain that many home routers push to DHCP clients. – Joel E Salas Jul 8 '12 at 18:36
@JoelESalas I know that but still it could have been a clue. Asking doesn't hurt ;) – Christopher Perrin Jul 8 '12 at 18:58
@ChristopherPerrin No, it's not a gateway, I don't even think routing is enabled. I will check that tomorrow morning, thanks for the tip. – HOLOGRAPHICpizza Jul 9 '12 at 2:09

iftop looks at all packets going through the interface using pcap (packet capture).

netstat shows sockets on the machines.

Any packet that’s forwarded to another host will appear in the former, not the latter.

Looks like all of the packets found to port 21095 were almost alone. It could be failing connection attempts.

share|improve this answer

Those are most certainly failed connection attempts. Check out with tcpdump; you should see them along with your host's ICMP port unreachable (since you don't have anything listening on that port):

01:58:31.471535 IP > UDP, length 35
01:58:31.472006 IP > ICMP udp port 21095 unreachable, length 71

(example supposing it's UDP)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.