2

Novell Linux server used for Novell Access Gateway. When I run netstat -a I get thousands of CLOSE_WAIT state connections from localhost:xxxx to localhost:snpp.

1st question how can I trace the connection to its source. Source being the executable causing it.

2nd question is that normal for this kind of server? I'm reading about SNPP online and all I see is it's a pager related protocol. I'm not doing anything pager related on this server.

Thanks

0

You almost had it with netstat, try netstat -ape

  • -a for all listening & non-listening sockets
  • -p to show the PID (and name) of the application that created the sockets
  • -e show extra information (can't hurt)

SNPP could be a false alarm, with out -n netstat will automatically lookup the port number (SNPP is port 444) and return the name, as defined in /etc/services

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.