2

I'm having problems with my server, and have been using iftop to show connections to and from the server in real time.

It shows an IP address that is constantly connected to/from me, but I can't find any information about what it is used for.

How can I find out what exactly that ip is doing with my server?

EDIT: with help of the answers, I was able to see with iftop the following

my.ip.address:46414 => 199.16.156.20:https

Then with netstat -a I see the following

tcp        0      0 my.ip.address:46414 199.16.156.20:https     ESTABLISHED

I do have an apache web server, but that IP is not showing on the logs. And furthermore, why is it connecting to port 46414?? What is he doing!

Thanks

EDIT2: Ok, thanks to the answer of Daniel t. I'm getting closer. I tried with lsof -i:46475 and this is the output

COMMAND   PID     USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
apache2 22003 www-data   19u  IPv4 716074      0t0  TCP ns.arg2.wirall.com:46475

So it looks like apache is doing something... but as it is an outbound connection, how can I know what is it really doing??

3
  • Determine whether it is an inbound or outbound connection. Then determine what port it is using. netstat -a | grep 1.2.3.4 (replace with ip) Mar 21, 2013 at 19:39
  • Hi David, I added more information to the question, please check it out
    – Jan
    Mar 21, 2013 at 20:13
  • You can check out the ancestors of the process with pstree and you can see what it is doing at the system call level with strace. Mar 28, 2013 at 9:04

5 Answers 5

7

46414 is a randomly generated port created by your OS. This is done for outgoing ports to maintain the session.

It is the connecting port that you need to look at, and that would be 443 as indicated by https. This means your IP is actually connecting via https to a remote server, not the other way around.

1
  • Great, thank you for clearing that up for me. I would upvote it as it was helpful but I don't have enough reputation yet :(
    – Jan
    Mar 21, 2013 at 20:27
1

With the following options, you can debug further(port information):

iftop -i eth0 -P

Some of the ports(like 80 dest) will be translated to the service name(www), or 25 to smtp. The others, you'll have to figure out on the IANA port Assignment:

http://www.ietf.org/assignments/port-numbers

You could use tcpdump too, but if there is heavy traffic, it will show lots of informations on your screen.

6
  • Ok, I see port numbers, but what are they doing with that??? For example, I'm seeing this now: myip:46163 => 199.16.156.20:https
    – Jan
    Mar 21, 2013 at 19:50
  • Are you running a local webserver that you're connected to? :)
    – tink
    Mar 21, 2013 at 19:55
  • yes I am, but that IP is not showing on the apache logs. And why is it using port 46163???
    – Jan
    Mar 21, 2013 at 20:03
  • I added more information to the question, please check it out
    – Jan
    Mar 21, 2013 at 20:12
  • +1 doesnt answer the edited question, but 100% correct in diagnosing per the original context. Mar 21, 2013 at 20:19
1

It looks like your machine is making an outbound connection to a remote server on port 443. Use your favorite network sniffer (ngrep, tcpdump, etc.) and look at connections to the remote ip and port 443.

1

Do lsof -i:46414 and you will see which process/command, PID, User ... etc has initiated the connection to the remote server. By the way, that remote server IP is owned by Twitter - http://www.mensus.net/browser/ipis.shtml?url=199.16.156.20.

3
  • That command is not outputting anything... no error either... any idea? By the way, that link you gave me is very helpful as well! I would upvote you but I don't have enough rep yet! :(
    – Jan
    Mar 21, 2013 at 20:53
  • The session using the port 46414 might have terminated. If the connection to that IP is still there, try lsof -i:443 -n | grep 99.16.156.20. You won't get any output, if the connection is terminated.
    – Daniel t.
    Mar 21, 2013 at 20:57
  • My bad, I entered another port (it was using another now). I'm editing my question to include the output of this command... check it out in a minute! thanks!
    – Jan
    Mar 21, 2013 at 20:58
0

Taking all the answers into account, it appears to me that there is a script or a web page on your web server that is making this connection. I base this on the fact that it's the webserver user that owns the connection, and that it's to an outbound server.

I'd certainly be worried about this, especially given that the name of the remote server is ns..... This sounds to me as though there's some malicious script on your site that's connecting to another server that has been compromised. Of course, it's equally possible that somebody is using e.g. mod_proxy to fetch pictures or javascripts from the remote server, but it's not exactly common to do that over HTTPS.

So my advice is to go through the web pages and scripts used on your site, and trying to find one that contains a request to that server. If you have an idea of when it started, you can use find /path/to/webserver/contents -mtime -15 if you think it started 15 days ago, to list all files that were changed for the last 15 days.

You might also want to drop traffic for 199.16.156.20 in your firewall, but I should still be vigilant to see whether your server starts doing connections to some other remote site.

Speaking of firewalls - in general, I'd say that a web server should not be allowed to initiate connections to the outside world, except for necessary services such as DNS, email (possibly only to your main relay server) and connections to the relevant upgrade services for your operating system. Inbound connections should only be allowed for SSH from your own network, and for your web server ports.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .