I have this person(or bot) from an IP in Chile which has an "ESTABLISHED" connection to SSHD as root on my server.

I'm trying to understand what netstat's outputs really mean, the manual doesn't really provide much details about them. Here's what I get:

root@linode [~]# netstat -tanpc|grep
tcp        0    840           ESTABLISHED 12016/sshd
tcp        0     21           ESTABLISHED 12020/sshd
tcp        0      0           SYN_RECV    -
tcp        0      1           FIN_WAIT1   -
tcp        0     84           ESTABLISHED 12022/sshd
tcp        0     52           ESTABLISHED 12024/sshd
tcp        0      0           ESTABLISHED 12026/sshd
tcp        0    720           ESTABLISHED 12028/sshd
tcp        0      0           ESTABLISHED 12030/sshd
tcp        0      0           ESTABLISHED 12032/sshd
tcp        0     21           ESTABLISHED 12034/sshd
tcp        0      0           SYN_RECV    -
tcp        0     84           ESTABLISHED 12036/sshd
tcp        0     52           ESTABLISHED 12038/sshd
tcp        0      0           ESTABLISHED 12040/sshd
tcp        0    720           ESTABLISHED 12042/sshd
tcp        0      0           ESTABLISHED 12044/sshd
tcp        0    840           ESTABLISHED 12047/sshd
tcp        0     21           ESTABLISHED 12056/sshd
tcp        0      0           SYN_RECV    -
tcp        0     84           ESTABLISHED 12058/sshd

What I understand from the above output is that this person(or bot?) is changing ports every second and so a new PID for SSHD is created every time he(or it) "establishes" a connection. Am I right?

Next and more important thing I'd like to ask is does the "ESTABLISHED" state here mean that he(or it) actually has access to my server as the root user? Or if I'm right at my assumption above, does this mean he(or it) is scanning for ports in my server, still trying to get in?

  • Most systems log authentication events. Where depends on the distribution / OS like /var/log/secure for Redhat and derivatives (Centos, Oracle Linux etc) and /var/log/auth.log for Debian and derivatives (Ubuntu etc). – Brian May 8 '15 at 20:34

Established only means that the connection is fully open and data can be transmitted. It doesn't necessarily mean that any data has been transmitted! It doesn't imply anything about layer 7, whether someone has authenticated to your system or not. You can check your system logs to learn if someone has authenticated successfully.

  • Thanks for clarifying that about the "established" state. That's what I'm actually worried about. I have set this server to send me an email every time a successful root login happens (I am using WHM/cPanel on this server). And it works when I login as root, I get an email. I'm not sure if it might be possible for root logins/successful authentication to happen without triggering the email notification I have set. Please excuse me, I'm relatively new to managing servers. Where do I find those system logs that you're talking about? I have CentOS 6.6 on this server, again with WHM/cPanel. – Nim LeFleur May 8 '15 at 20:19
  • All the system logs are in /var/log. I don't know what cPanel does; it is not a supportable topic here. You probably want to familiarize yourself with the system documentation. – Michael Hampton May 8 '15 at 20:23

Established means that the user on the other end has an open connection and so things like "shutdown -I" should work except if obviously you cannot do that anyway. I only worry about the outputs labelled Established unless the other ones are needed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.