I connect to my server via ssh. I am the only person who has access to connect to the server. After connecting via ssh, I run the following command:

sudo netstat -tupn

The output includes the following two lines:

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address
tcp        0      0 MY.SERVER.IP.ADDRESS:22       MY.HOME.IP.ADDRESS:54886     ESTABLISHED 18677/0
tcp        0    324 MY.SERVER.IP.ADDRESS:22       MY.HOME.IP.ADDRESS:55096     ESTABLISHED 18843/1

Based on my limited knowledge, it seems like these two lines from the output are related to my ssh connection. I believe this is true because the port is 22, and the foreign address is my home IP address.

I'm trying to understand what these 2 lines represent. Why are there two connections shown for my single ssh connection?

Also, would netstat a good tool to use to see if someone has gained unauthorized access to my server? If someone did, would I see their connection in the netstat output?

  • i don't know why you're seeing that twice, could it be a stale prior connection? I do know a great way to prevent people from even trying to access your server is to change your SSH port from the default 22 to something really high like 9002 or 22022 – user16081-JoeT Aug 27 '15 at 1:12
  • what does the ps auxf show about sshd processes. Are there also two of them? What is your configuration? Do you use port forward? Or Agent forwarding? – Jakuje Aug 27 '15 at 8:38
  • It seems that there is now only one process shown. Maybe it was some sort of stale connection that had to get cleaned up. Yes, I'm using Agent forwarding. – flyingL123 Aug 27 '15 at 12:49

The lines appear to indicate 2 active (ESTABLISHED state) ssh connections from your home machine (one maybe from an scp operation in progress or a ssh session from a different terminal or some backgrounded shell?).

The lines include the PIDs for the processes they correspond to on the last column, 18677 and 18843 in your case. You can check what processes they are (ps -ef | grep <PID>). For normal ssh connections they'd be sshd processes.

You can also find out which PIDs on your home machine they correspond to by running sudo netstat -tupn on your home machine, you'd see something along these lines (note the matching IP_ADDRESS:PORT_NUM values but with the local and foreign/remote addresses columns reversed):

Proto Recv-Q Send-Q Local Address                  Foreign Address             State       PID/...

tcp        0      0 MY.HOME.IP.ADDRESS:54886       MY.SERVER.IP.ADDRESS:22     ESTABLISHED PID1/...
tcp        0      0 MY.HOME.IP.ADDRESS:55096       MY.SERVER.IP.ADDRESS:22     ESTABLISHED PID2/...

From the corresponding pids you can then find the corresponding processes, their parents, etc.

Yes, netstat is a good tool to use. As long as the unauthorized access doesn't manage to circumvent somehow the way in which netstat works (which IMHO is possible, but not very likely for common attacks) you should be able to see such active connections and maybe even traces of those terminating or very recently terminated (states likes TIME_WAIT or CLOSE_WAIT).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.