Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Many times, after running netstat on my server, I find one of IP addresses belonging to deploy.akamaitechnologies.com connected to my server, do someone has an idea on what is happening on my server ?

this is a case:

TCP xxx.xxx.xxx.xxx:49189 a184-25-107-184:http ESTABLISHED

To what could serve the port: 49189 when the source machine is running http ?

share|improve this question
1  
Your question is based on the false assumption that they are connecting to you. If you look closely at the ports, you can see that it is almost certain that you are connecting to them. –  David Schwartz Oct 16 '12 at 22:22
add comment

3 Answers

up vote 1 down vote accepted

Your server is connecting to HTTP on the deploy.akamaitechnologies.com server, not the other way around. Run netstat -a -n -o on your server and see what PID (process ID) is responsible for the connection and investigate from there.

share|improve this answer
add comment

that's a dynamic port that TCP needs to make a connection, if you really want to find out more look in your apache's log grep for that IP and see what this IP is doing, block it if you have too.

share|improve this answer
    
I am on IIS 7, how can I see what this IP is doing, and how can I block it please? –  AlphaBird Oct 16 '12 at 21:37
    
look in your IIS log what this IP is doing on your box so extensively to block it you can use IIS as well (or firewall) –  alexus Oct 16 '12 at 21:46
    
Is there an iis log viewer / analyzer inside Windows 2008 R2, or have I to dowload it somewhere ? I can block the used IP address through the firewall but each time they use a different one, I mean: deploy.akamaitechnologies.com –  AlphaBird Oct 16 '12 at 21:57
    
Why would he look in his Apache log? It's the local port that's dynamic. –  David Schwartz Oct 16 '12 at 22:21
    
@David, So you think that something installed on my server connects to them from time to time? –  AlphaBird Oct 16 '12 at 22:35
show 2 more comments

Even if you turn windows updates off and remove Adobe then deploy.akamaitechnologies.com is still be called using static ip-addresses that change each time and this happens during log on and before you have a chance to run something to block them

since you don't know all the ip-addresses then its not possible to block using windows firewall and you won't find the domain name or ip-address in the registry or even in any of the files on your c-drive so someone has gone to a great deal of trouble to connect you to one of akamai servers and you can bet they are upto no good

it's my machine, i will decide who and when i make a connection and what i want to block and not spy the master general at microsoft or anyone else for that matter.

current IP's used to bypass security are

213.120.161.155 Server: AkamaiGHost 213.120.161.186 80.150.133.34 80.150.193.17 92.123.99.235

Sometime the host process is srvhost ran and ran "local" and other times it from another process ran as "system".

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.