Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm pretty new to system administration, and I've been trying to get more familiar with tools like netsat. If I run netstat -n on my server, I see this line:

tcp        0      0 xxx.xxx.xxx.xxx:44573          xxx.xxx.xxx.xxx:443         ESTABLISHED

However, I'm using iptables with a default policy of DROP and 44573 isn't one of the ports I allow traffic to. My rules look like this in iptables:

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pcsync-https state NEW,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:21022 state NEW,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http state NEW,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https state NEW,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp state NEW,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp dpts:65500:65534
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:webcache state NEW,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:http state ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:https state ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
ACCEPT     all  --  anywhere             anywhere
ACCEPT     udp  --  anywhere             anywhere            udp spt:domain
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp state NEW,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http limit: avg 25/min burst 100

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:pcsync-https state ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:21022 state ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:http state ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:https state ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:ftp state ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:webcache state ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http state NEW,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https state NEW,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply
ACCEPT     all  --  anywhere             anywhere
ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:smtp state ESTABLISHED

Is anyone able to shed some light on this? Am I just interpreting this wrong?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

The most likely explanation is that you're seeing an outbound connection from your machine to an HTTPS port. Port 44573 is an ephemeral port that a program on your machine was given when it made an outbound HTTPS request.

netstat doesn't specifically show outbound versus inbound, but since you don't have any programs listening on port 44573, port 44573 is in the ephemeral port range, and the remote machine's port (443) is not a in the ephemeral port range (and is a port used for a common server protocol) it can be reasonably assured that it's an outbound connection.

share|improve this answer
    
Is there a way to identify outgoing vs incoming connections? –  Brandon Wamboldt Feb 10 '13 at 23:21
    
When using netstat the local ip address and port (the ip address and port of the machine running netstat) is on the left and the remote ip address and port is on the right. In your example, the machine you're running netstat on has established a connection FROM port 44573 TO port 443 on a remote host. –  joeqwerty Feb 10 '13 at 23:30
    
One way to determine incoming from outgoing connections is to know what services are running on your machine, which of those services accept incoming network connections, and a familiarity with the common ports used by various services/protocols. For instance if the local port were 443 and the remote port were 44573 then you would surmise that the remote host established an inbound connection to port 443 on the local host. –  joeqwerty Feb 10 '13 at 23:38

Evan is quite correct.

As an aside, you have:

Chain OUTPUT (policy ACCEPT)

then a series of ACCEPT rules in the OUTPUT chain, and no REJECT rules, so apart from accounting output is completely open.

That's fine if it's what you intend.. but I'd expect to see a LOG rule so you can see "unexpected but still allowed traffic" in the OUTPUT rules and "unexpect and denied traffic" in the INPUT rules.

Plus, if you're not really interested in the packet accounting.. you could just have a blanket "--state RELATED,ESTABLISHED -j ACCEPT" rule at the top of INPUT/OUTPUT

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.