I run a moderately active website on a dedicated server. In the course of protecting against (D)DOS attacks, I ran netstat to get a count of active connections. This produced a rather unusual result in that it showed 1000+ connections from the httpd port of the server's public ip-address to many different seemingly random ports on the same ip-address. That is, the output looks like this:
Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 [server's ip]:60284 [server's ip]:80 TIME_WAIT tcp 0 0 [server's ip]:60267 [server's ip]:80 TIME_WAIT ... [1000+ just like this]
The state of these is TIME_WAIT but that may be because I run a firewall that doesn't allow access to these ports. This server does communicate with a database on another machine but that should all be done through a private ip. So if this is valid communication, I'd like to figure that out so I can set it to use the private ip (where the ports are accessible).
Does anyone know why the machine would attempt to communicate with itself over its public ip? How would I determine what process is initiating this? I tried to look at these ports via lsof but that did not return any information.
The only unusual thing that our server runs with httpd is the rather outdated persistent-perl program (to cache perl scripts in memory). However, I'm quite certain that would not involve use of the network and there is no information that indicates how that would work.
Thanks in advance for any advice!