Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having problems with my server, and have been using iftop to show connections to and from the server in real time.

It shows an IP address that is constantly connected to/from me, but I can't find any information about what it is used for.

How can I find out what exactly that ip is doing with my server?

EDIT: with help of the answers, I was able to see with iftop the following

my.ip.address:46414 => 199.16.156.20:https

Then with netstat -a I see the following

tcp        0      0 my.ip.address:46414 199.16.156.20:https     ESTABLISHED

I do have an apache web server, but that IP is not showing on the logs. And furthermore, why is it connecting to port 46414?? What is he doing!

Thanks

EDIT2: Ok, thanks to the answer of Daniel t. I'm getting closer. I tried with lsof -i:46475 and this is the output

COMMAND   PID     USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
apache2 22003 www-data   19u  IPv4 716074      0t0  TCP ns.arg2.wirall.com:46475

So it looks like apache is doing something... but as it is an outbound connection, how can I know what is it really doing??

share|improve this question
    
Determine whether it is an inbound or outbound connection. Then determine what port it is using. netstat -a | grep 1.2.3.4 (replace with ip) –  David Houde Mar 21 '13 at 19:39
    
Hi David, I added more information to the question, please check it out –  Jan Mar 21 '13 at 20:13
    
You can check out the ancestors of the process with pstree and you can see what it is doing at the system call level with strace. –  reinierpost Mar 28 '13 at 9:04
add comment

5 Answers

Taking all the answers into account, it appears to me that there is a script or a web page on your web server that is making this connection. I base this on the fact that it's the webserver user that owns the connection, and that it's to an outbound server.

I'd certainly be worried about this, especially given that the name of the remote server is ns..... This sounds to me as though there's some malicious script on your site that's connecting to another server that has been compromised. Of course, it's equally possible that somebody is using e.g. mod_proxy to fetch pictures or javascripts from the remote server, but it's not exactly common to do that over HTTPS.

So my advice is to go through the web pages and scripts used on your site, and trying to find one that contains a request to that server. If you have an idea of when it started, you can use find /path/to/webserver/contents -mtime -15 if you think it started 15 days ago, to list all files that were changed for the last 15 days.

You might also want to drop traffic for 199.16.156.20 in your firewall, but I should still be vigilant to see whether your server starts doing connections to some other remote site.

Speaking of firewalls - in general, I'd say that a web server should not be allowed to initiate connections to the outside world, except for necessary services such as DNS, email (possibly only to your main relay server) and connections to the relevant upgrade services for your operating system. Inbound connections should only be allowed for SSH from your own network, and for your web server ports.

share|improve this answer
add comment

Do lsof -i:46414 and you will see which process/command, PID, User ... etc has initiated the connection to the remote server. By the way, that remote server IP is owned by Twitter - http://www.mensus.net/browser/ipis.shtml?url=199.16.156.20.

share|improve this answer
    
That command is not outputting anything... no error either... any idea? By the way, that link you gave me is very helpful as well! I would upvote you but I don't have enough rep yet! :( –  Jan Mar 21 '13 at 20:53
    
The session using the port 46414 might have terminated. If the connection to that IP is still there, try lsof -i:443 -n | grep 99.16.156.20. You won't get any output, if the connection is terminated. –  Daniel t. Mar 21 '13 at 20:57
    
My bad, I entered another port (it was using another now). I'm editing my question to include the output of this command... check it out in a minute! thanks! –  Jan Mar 21 '13 at 20:58
add comment

46414 is a randomly generated port created by your OS. This is done for outgoing ports to maintain the session.

It is the connecting port that you need to look at, and that would be 443 as indicated by https. This means your IP is actually connecting via https to a remote server, not the other way around.

share|improve this answer
    
Great, thank you for clearing that up for me. I would upvote it as it was helpful but I don't have enough reputation yet :( –  Jan Mar 21 '13 at 20:27
add comment

It looks like your machine is making an outbound connection to a remote server on port 443. Use your favorite network sniffer (ngrep, tcpdump, etc.) and look at connections to the remote ip and port 443.

share|improve this answer
add comment

With the following options, you can debug further(port information):

iftop -i eth0 -P

Some of the ports(like 80 dest) will be translated to the service name(www), or 25 to smtp. The others, you'll have to figure out on the IANA port Assignment:

http://www.ietf.org/assignments/port-numbers

You could use tcpdump too, but if there is heavy traffic, it will show lots of informations on your screen.

share|improve this answer
    
Ok, I see port numbers, but what are they doing with that??? For example, I'm seeing this now: myip:46163 => 199.16.156.20:https –  Jan Mar 21 '13 at 19:50
    
Are you running a local webserver that you're connected to? :) –  tink Mar 21 '13 at 19:55
    
yes I am, but that IP is not showing on the apache logs. And why is it using port 46163??? –  Jan Mar 21 '13 at 20:03
    
I added more information to the question, please check it out –  Jan Mar 21 '13 at 20:12
    
+1 doesnt answer the edited question, but 100% correct in diagnosing per the original context. –  David Houde Mar 21 '13 at 20:19
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.