Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Many times, after running netstat on my server, I find one of IP addresses belonging to connected to my server, do someone has an idea on what is happening on my server ?

this is a case:

TCP a184-25-107-184:http ESTABLISHED

To what could serve the port: 49189 when the source machine is running http ?

share|improve this question
Your question is based on the false assumption that they are connecting to you. If you look closely at the ports, you can see that it is almost certain that you are connecting to them. – David Schwartz Oct 16 '12 at 22:22
up vote 2 down vote accepted

Your server is connecting to HTTP on the server, not the other way around. Run netstat -a -n -o on your server and see what PID (process ID) is responsible for the connection and investigate from there.

share|improve this answer

that's a dynamic port that TCP needs to make a connection, if you really want to find out more look in your apache's log grep for that IP and see what this IP is doing, block it if you have too.

share|improve this answer
I am on IIS 7, how can I see what this IP is doing, and how can I block it please? – Sami-L Oct 16 '12 at 21:37
look in your IIS log what this IP is doing on your box so extensively to block it you can use IIS as well (or firewall) – alexus Oct 16 '12 at 21:46
Is there an iis log viewer / analyzer inside Windows 2008 R2, or have I to dowload it somewhere ? I can block the used IP address through the firewall but each time they use a different one, I mean: – Sami-L Oct 16 '12 at 21:57
Why would he look in his Apache log? It's the local port that's dynamic. – David Schwartz Oct 16 '12 at 22:21
@David, So you think that something installed on my server connects to them from time to time? – Sami-L Oct 16 '12 at 22:35

Even if you turn windows updates off and remove Adobe then is still be called using static ip-addresses that change each time and this happens during log on and before you have a chance to run something to block them

since you don't know all the ip-addresses then its not possible to block using windows firewall and you won't find the domain name or ip-address in the registry or even in any of the files on your c-drive so someone has gone to a great deal of trouble to connect you to one of akamai servers and you can bet they are upto no good

it's my machine, i will decide who and when i make a connection and what i want to block and not spy the master general at microsoft or anyone else for that matter.

current IP's used to bypass security are Server: AkamaiGHost

Sometime the host process is srvhost ran and ran "local" and other times it from another process ran as "system".

share|improve this answer

This may be old news by now, but I ran into the same issue as Alpha Bird and Google was not very clarifying about Akamai Technologies - only that it is seemed pretty harmless judging by the information that is available online (e.g. Wikipedia and the company website).

Anyway, Joe Qwerty's reply above put me on the right track to solve the mystery on my system, which is CentOS 6.6 by the way. On linux netstat -a -n -o --tcp --program demonstrated that the clock-applet was retrieving it's information from AKamai Technologies. Turning the clock in the task bar off made the http (port 80) connections go away. It also confirmed that it was pretty harmless, basically.

share|improve this answer

So, I've discovered that Windows 8 now apparently automatically (i.e. without asking or without one going to the Windows app store) downloads the 8.1 service pack after installing some 8.0 updates.

This download seemed to come from a-{some-numbers-and-dashes} and took up about 3GB + 0.5 to 0.7GB (2 parts), downloading at a rate of about 10Mb/sec on my ADSL2 connection.

If you see this huge a download, and you get a 8.1 auto-install-now-yes/no notification then it looks like this is it. Thus, maybe Microsoft is using this service also.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.