Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I see lot of tcp connections on different ports on my server with 'TIME_WAIT' status. Just simple port scan, but i cant see ip address of this bastard because connections is going from my nginx. Can you please give me a tip how can i see IP address of this bastard?

Here is example:

[root@vh9 ~]# netstat
tcp        0      0 srv:http                    srv:53280                   TIME_WAIT
tcp        0      0 srv:http                    srv:53536                   TIME_WAIT
tcp        0      0 srv:http                    srv:52768                   TIME_WAIT
tcp        0      0 srv:http                    srv:53024                   TIME_WAIT
share|improve this question

This is not a port scan, it's perfectly valid connections from your nginx to apache backend.

share|improve this answer
No, i haven't any services on this ports. My backend running on – Jaels Nov 10 '12 at 10:32
These are source ports, they are expected to be random. They are listed in the "Foreign Address" column just because you are looking at backend's side of connections. – Maxim Dounin Nov 10 '12 at 10:40
Hmm, that can be true :) – Jaels Nov 10 '12 at 10:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.