0

netstat is showing a lot of unknown connections from different strange places. are they just attempt to establish connection? or is my server compromised? I've removed my local addresses from the log below:

      STREAM     CONNECTED     8353   P8352
[root@ns512646 ~]# netstat
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State      
tcp        0      0             s1.securityresearch.3:60000 ESTABLISHED 
tcp        0      0          hn.kd.ny.adsl:17353         ESTABLISHED 
tcp        0      0           s4.securityresearch.3:60000 ESTABLISHED 
tcp        0      0          s3.securityresearch.3:60000 ESTABLISHED 
tcp        0      0           hn.kd.ny.adsl:28534         ESTABLISHED 
tcp        0      0          s4.securityresearch.3:60000 ESTABLISHED 

1
  • What local port(s) that sessions are connected to?
    – Kondybas
    Oct 6, 2015 at 7:49

2 Answers 2

0

If you type netstat -na it will give you more details, you have server and you are not aware of what is connected to it.

Also, this is very basic request, referring to man netstat would have spared you to fire such request.

0

If the connections are ESTABLISHED, than that means the remote connecting host has successfully negotiated a session with some service listening on your host.

Removing the Local Address column here unfortunately omits key information. What you want to know is what services/ports these remote hosts are connecting to on your machine, and if that traffic is legitimate/expected or not.

You can add the -p flag to netstat to give you the PID and program name of the processes that are listening on these ports. (Requires root privs to see processes other than your own), and -e to show which user the process is running as.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .