Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I see lot of tcp connections on different ports on my server with 'TIME_WAIT' status. Just simple port scan, but i cant see ip address of this bastard because connections is going from my nginx. Can you please give me a tip how can i see IP address of this bastard?

Here is example:

[root@vh9 ~]# netstat
tcp        0      0 srv:http                    srv:53280                   TIME_WAIT
tcp        0      0 srv:http                    srv:53536                   TIME_WAIT
tcp        0      0 srv:http                    srv:52768                   TIME_WAIT
tcp        0      0 srv:http                    srv:53024                   TIME_WAIT
share|improve this question

1 Answer 1

This is not a port scan, it's perfectly valid connections from your nginx to apache backend.

share|improve this answer
1  
No, i haven't any services on this ports. My backend running on 127.0.0.1:80 –  Jaels Nov 10 '12 at 10:32
1  
These are source ports, they are expected to be random. They are listed in the "Foreign Address" column just because you are looking at backend's side of connections. –  Maxim Dounin Nov 10 '12 at 10:40
    
Hmm, that can be true :) –  Jaels Nov 10 '12 at 10:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.