Just to be on the safe side, if you're running tcpdump
and nothing is listening on port 12337, you should see the connection being "Reset" like so:
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
23:12:41.063781 IP 1.1.1.1.57039 > 2.2.2.2.12337: S 2687592758:2687592758(0) win 65535 <mss 1452,nop,wscale 3,nop,nop,timestamp 444707996 0,sackOK,eol>
23:12:41.063805 IP 2.2.2.2.12337 > 1.1.1.1.57039: R 0:0(0) ack 2687592759 win 0
Notice on the last line: R 0:0(0)
, which indicates the connection was "Reset". If you see this:
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
23:14:46.434607 IP 1.1.1.1.57058 > 2.2.2.2.12337: S 3988391384:3988391384(0) win 65535 <mss 1452,nop,wscale 3,nop,nop,timestamp 444709249 0,sackOK,eol>
23:14:46.434659 IP 2.2.2.2.12337 > 1.1.1.1.57058: S 1969317214:1969317214(0) ack 3988391385 win 5792 <mss 1460,sackOK,timestamp 171652775 444709249,nop,wscale 7>
23:14:46.562977 IP 1.1.1.1.57058 > 2.2.2.2.12337: . ack 1 win 65535 <nop,nop,timestamp 444709251 171652775>
In other words, S
yn, S
yn-ack
, and an ack
, it means that the remote IP made a successful connection to your system on that port. If netstat
is not showing anything listening on that port, it's very likely your system was rooted and you should probably take it off the network and investigated.