I see lot of tcp connections on different ports on my server with 'TIME_WAIT' status. Just simple port scan, but i cant see ip address of this bastard because connections is going from my nginx. Can you please give me a tip how can i see IP address of this bastard?

Here is example:

[root@vh9 ~]# netstat
tcp        0      0 srv:http                    srv:53280                   TIME_WAIT
tcp        0      0 srv:http                    srv:53536                   TIME_WAIT
tcp        0      0 srv:http                    srv:52768                   TIME_WAIT
tcp        0      0 srv:http                    srv:53024                   TIME_WAIT

This is not a port scan, it's perfectly valid connections from your nginx to apache backend.

| improve this answer | |
  • 1
    No, i haven't any services on this ports. My backend running on – Jaels Nov 10 '12 at 10:32
  • 1
    These are source ports, they are expected to be random. They are listed in the "Foreign Address" column just because you are looking at backend's side of connections. – Maxim Dounin Nov 10 '12 at 10:40
  • Hmm, that can be true :) – Jaels Nov 10 '12 at 10:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.