LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 01-28-2008, 05:41 AM   #1
Sheridan
Member
 
Registered: Aug 2007
Location: Hungary
Distribution: Fedora, CentOS
Posts: 89

Rep: Reputation: 21
Unhappy Courious "unknown" entries in "netstat" output


Lately, I've ben starting to see some strange entries in netstat output:

Please note the line with [UNKNOWN]:10410...

Code:
tcp        0      0 11.0.37.1:41991             mysql.ccv:mysql             ESTABLISHED
tcp        0      0 11.0.37.1:41963             mysql.ccv:mysql             ESTABLISHED
tcp        0      0 11.0.37.1:50594             mysql.ccv:mysql             ESTABLISHED
getnameinfo failed
tcp        0      0 estdtagwy01.tech.nmsama:ssh [UNKNOWN]:10410             ESTABLISHED
tcp        0      0 estdtagwy01.tech.nmsama:ssh ::ffff:11.0.38.12:sis-emt   ESTABLISHED
tcp        0      0 estdtagwy01.tech.nmsama:ssh admin.unideb.hu:46541     ESTABLISHED
What can cause this? I'm getting real concerned that I may be compromised.

(Edited typo)
 
Old 01-28-2008, 05:47 AM   #2
Sheridan
Member
 
Registered: Aug 2007
Location: Hungary
Distribution: Fedora, CentOS
Posts: 89

Original Poster
Rep: Reputation: 21
Update:

With lsof I managed to find out that it's the extern. IP of our outsource partner for development and they do legitimate work on the server...

However... I still don't understand why netstat shows UNKNOWN...

(Also, I guess this thread no longer belongs to "security", but rather "Networking"...)

Last edited by Sheridan; 01-28-2008 at 06:01 AM.
 
Old 01-28-2008, 07:17 AM   #3
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,543
Blog Entries: 54

Rep: Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924
Try using 'dig -x' to resolve the IP address and see what errors it returns.
Maybe some DNS server claiming not being authoritative where it should be or like that.
BTW 'netstat -n' is faster because it doesn't need to resolve IP to hostname resolution first.
 
Old 01-28-2008, 10:24 AM   #4
Sheridan
Member
 
Registered: Aug 2007
Location: Hungary
Distribution: Fedora, CentOS
Posts: 89

Original Poster
Rep: Reputation: 21
Quote:
Originally Posted by unSpawn View Post
Try using 'dig -x' to resolve the IP address and see what errors it returns.
Thanks!

I get this when I try resolving their external IP:

Code:
[root@estdtagwy01 ~]# dig -x 125.16.20x.xxx

; <<>> DiG 9.4.2 <<>> -x 125.16.20x.xxx
;; global options:  printcmd
;; connection timed out; no servers could be reached

... however, resolving something else like this, works fine:

Code:
[root@estdtagwy01 ~]# dig -x 209.85.135.99

; <<>> DiG 9.4.2 <<>> -x 209.85.135.99
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1987
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4

;; QUESTION SECTION:
;99.135.85.209.in-addr.arpa.    IN      PTR

;; ANSWER SECTION:
99.135.85.209.in-addr.arpa. 2006 IN     PTR     mu-in-f99.google.com.

;; AUTHORITY SECTION:
135.85.209.in-addr.arpa. 10718  IN      NS      ns1.google.com.
-----------CUT-----------

;; ADDITIONAL SECTION:
ns4.google.com.         4952    IN      A       216.239.38.10
-----------CUT-----------

;; Query time: 2 msec
;; SERVER: 11.0.37.1#53(11.0.37.1)
;; WHEN: Mon Jan 28 17:21:29 2008
;; MSG SIZE  rcvd: 214
So... it seems to be with this one IP only so far.

Now they have left office for today so I cannot investigate further until tomorrow...
 
Old 09-01-2009, 08:36 AM   #5
deadeyes
Member
 
Registered: Aug 2006
Posts: 605

Rep: Reputation: 79
Sorry to bump this thread up again...
But I still wonder why UNKNOWN is in the Foreign Address column.

I tried to find an answer on this question on google but without luck.

Does anyone know what conditions trigger the UNKNOWN text to be shown?

Last edited by deadeyes; 09-01-2009 at 08:37 AM.
 
Old 09-01-2009, 10:09 AM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,543
Blog Entries: 54

Rep: Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924
If you don't supply "-n" then I'd say resolution errors. If that doesn't do it for you then you could always get the "net-tools" source and see if 'grep -r . -e UNKNOWN' or reading netstat.c at around lines 902, 1162 and 1195 (valid for net-tools-1.60) makes more sense.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
net working eth0 eth1 wlan0 "no connection" "no LAN" "no wi-fi" Cayitano Linux - Newbie 5 12-09-2007 08:11 PM
Standard commands give "-bash: open: command not found" even in "su -" and "su root" mibo12 Linux - General 4 11-11-2007 11:18 PM
LXer: Displaying "MyComputer", "Trash", "Network Servers" Icons On A GNOME Desktop LXer Syndicated Linux News 0 04-02-2007 09:31 AM
unknown entry in the output of "df -h " command Balakrishna Linux - Newbie 1 12-19-2006 01:17 AM
Conditional display of "HCL Entries" and "Reviews" ? J.W. LQ Suggestions & Feedback 1 09-01-2005 09:53 AM


All times are GMT -5. The time now is 03:19 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration