Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have connections like this showing frequently in iftop: => 480b 160b 40b

I have no idea what it is or where it's come from. A netstat -a shows:

udp        0      0 *:*
udp        0      0 *:*

At the moment I've thinking I've probably been hacked, but does anyone have a clever way of investigating things like this?

** EDIT **

I have had a look at it with a packet sniffer (tcpdump), searching for the I.P connecting in of > Flags [S], cksum 0xb2af (correct), seq 1417033873, win 65535, options [mss 1440,nop,nop,sackOK], length 0 > Flags [R.], cksum 0xdf4b (correct), seq 0, ack 1417033874, win 0, length 0

Transmission Control Protocol, Src Port: ms-sql-s (1433), Dst Port: vrts-ipcserver (1317), Seq: 1, Ack: 1, Len: 0
Source port: ms-sql-s (1433)
Destination port: vrts-ipcserver (1317)

Still don't really know what to make of it though


share|improve this question
I recommend a packet capture on the connecting IP . – jeffatrackaid Mar 27 '13 at 19:56
Thanks, I have done so (see above) – rastaboym Mar 27 '13 at 21:47

Just looking at the provided info, which is not much, I would say a Veritas software is communicating with a Ms-SQL database over the network. vrts-ipcserver stands for one of the admin services for a Veritas installation.

You can find info regarding Veritas ports in here:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.