LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 02-23-2009, 12:36 AM   #1
n00b1shzyx
LQ Newbie
 
Registered: Feb 2009
Posts: 7

Rep: Reputation: 0
Established connections?


Hi. I just installed my linux early this year and I am totally new to it. There's this question I've been meaning to ask regarding my net connections. Is it normal to have a TTL upto 119:59:59? Can somebody please explain it to me or you can direct me to a post,forum, or a site regarding this matter.

Here's the link: http://img179.imageshack.us/img179/2305/ttl1195959z.jpg. Thank you.
 
Old 02-24-2009, 01:33 AM   #2
JulianTosh
Member
 
Registered: Sep 2007
Location: Las Vegas, NV
Distribution: Fedora / CentOS
Posts: 674
Blog Entries: 3

Rep: Reputation: 90
first off, thanks for pointing out this cool utility... never seen it before.. It appears to be legitimate for persistent connections. I leave my IRC, gmail, some ssh sessions open from the time I boot and i've got large TTLs from all of those connections.

If you're unsure where those connections are going to, you can ease your mind a little by doing a nslookup on the IP to see who owns it. If you recognize the domain as something you use regularly then it should be ok.

The IP you showed us is registered to www.grc.com.

Code:
$ nslookup 4.79.142.202
Server:		68.105.28.11
Address:	68.105.28.11#53

Non-authoritative answer:
202.142.79.4.in-addr.arpa	name = www.grc.com.

Authoritative answers can be found from:
79.4.in-addr.arpa	nameserver = ns1.Level3.net.
79.4.in-addr.arpa	nameserver = ns2.Level3.net.
ns1.Level3.net	internet address = 209.244.0.1
ns2.Level3.net	internet address = 209.244.0.2
 
Old 02-24-2009, 04:38 AM   #3
n00b1shzyx
LQ Newbie
 
Registered: Feb 2009
Posts: 7

Original Poster
Rep: Reputation: 0
thanks for pointing that its actually called as persistent connections. you see, I use it in tandem with other few apps whenever I'm surfing online. is it also normal that when you are surfing or when you opened 3 tabs on your browser, that a 4th ip address connects to port 80 with a persistent connection? it doesn't show that its one of the ip addresses you just visited with your browser using showip extension.
 
Old 02-24-2009, 11:17 AM   #4
JulianTosh
Member
 
Registered: Sep 2007
Location: Las Vegas, NV
Distribution: Fedora / CentOS
Posts: 674
Blog Entries: 3

Rep: Reputation: 90
I just took a look at showip extension...

When you look at a web page, there can be many many other IPs access than just what's in the address bar. Any of the content on that page can come from any source really, creating multiple additional tcp connections.

But if you are suspicious of a connection being shown in iptstate that doesn't correlate to an opened web page, use nslookup to try and determine what that host name is.

Did you try that for this '4th ip' ? What was the result, and the web pages you were visiting?
 
Old 02-24-2009, 12:31 PM   #5
ceantuco
Member
 
Registered: Mar 2008
Location: New Jersey
Distribution: CentOS, Debian, Kali
Posts: 584

Rep: Reputation: 37
I have a question... Have any of you try installing this tool? I get this error message: [B]# make: *** [iptstate] Error 1[B] any suggestions?
Thx
 
Old 02-24-2009, 09:43 PM   #6
n00b1shzyx
LQ Newbie
 
Registered: Feb 2009
Posts: 7

Original Poster
Rep: Reputation: 0
@Admiral Beotch
I did try nslookup on that other ip, it seems that its of another member of my isp. I dunno, maybe I'm just so paranoid, but it usually connects whenever I'm surfing or browsing a website and whenever it did come my pc got hang or become so slow then I have to reboot. I could say that its a regular visitor coz I oftentimes see that on iptstate.

@ceantuco
sorry I'm not good at linux tarball installation process, but maybe its lacking on its dependencies. what's the whole error/process says?
 
Old 02-25-2009, 09:27 AM   #7
ceantuco
Member
 
Registered: Mar 2008
Location: New Jersey
Distribution: CentOS, Debian, Kali
Posts: 584

Rep: Reputation: 37
n00b1shzyx... this is what I do :

# make

+------------------------------------------------------------+
| Welcome to IP Tables State by Phil Dibowitz |
| |
| PLEASE read the LICENSE and the README for important info. |
| |
| You may also wish to read the README for install info, |
| the WISHLIST for upcoming features, BUGS for known bugs |
| and info on bug reports, and the Changelog to find out |
| what's new. |
| |
| Let's compile... |
+------------------------------------------------------------+

g++ -g -Wall -O2 iptstate.cc -o iptstate -lncurses
iptstate.cc: In function ‘void build_table(const flags_t&, const filters_t&, std::vector<t able_t, std::allocator<table_t> >&, counters_t&, max_t&)’:
iptstate.cc:809: error: ‘strerror’ was not declared in this scope
iptstate.cc: In function ‘int src_sort(const void*, const void*)’:
iptstate.cc:1969: error: ‘memcmp’ was not declared in this scope
iptstate.cc: In function ‘int dst_sort(const void*, const void*)’:
iptstate.cc:1974: error: ‘memcmp’ was not declared in this scope
make: *** [iptstate] Error 1

then I try:

# make install

/usr/bin/install -D --mode=755 iptstate /usr/sbin/iptstate
/usr/bin/install: cannot stat `iptstate': No such file or directory
make: *** [install] Error 1

I hope this helps... thanks! :=)
 
Old 02-25-2009, 09:40 AM   #8
ceantuco
Member
 
Registered: Mar 2008
Location: New Jersey
Distribution: CentOS, Debian, Kali
Posts: 584

Rep: Reputation: 37
I checked the README file and as pre-installation step says:

Make sure you have some version of curses installed (for most users
this is probably ncurses). Note that if you are using vendor packages
you will most likely need the packaged with '-dev' on the end of of
it (i.e. ncurses-dev).


I did:

# find / -name ncurses
/usr/share/doc/packages/ncurses
/usr/include/ncurses

and I did:

# find / -name ncurses-dev but nothing came up.
 
Old 03-01-2009, 03:57 PM   #9
hendomatic
LQ Newbie
 
Registered: Mar 2009
Posts: 1

Rep: Reputation: 0
Quote:
Originally Posted by ceantuco View Post
I checked the README file and as pre-installation step says:

Make sure you have some version of curses installed (for most users
this is probably ncurses). Note that if you are using vendor packages
you will most likely need the packaged with '-dev' on the end of of
it (i.e. ncurses-dev).


I did:

# find / -name ncurses
/usr/share/doc/packages/ncurses
/usr/include/ncurses

and I did:

# find / -name ncurses-dev but nothing came up.
I just figured this out today.

Its likely you're running gcc 4.3.2 like me and some of the include files arent included by default by gcc for c++.

if you go into iptstate.cc and add a line near the top with the rest of the includes:

#include <cstring>

It should compile.

If it doesnt, then you might look to make sure your compiler is complete.


I think this gets fixed in 4.3.3, but i'm not in a hurry to compile or download 4.3.3.

Hope this helps.

Dennis
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Cancel Established Connections landysaccount Linux - Newbie 3 11-17-2008 09:42 PM
Make sure the mount is established ust Linux - Software 5 08-02-2007 04:16 PM
ifconfig+no connection established coolirc Slackware 2 03-04-2007 03:12 PM
How to use ESTABLISHED,RELATED best? Pastorino Linux - Security 2 08-30-2005 06:21 PM
what is ESTABLISHED, RELATED or NEW gpagedar Linux - Networking 3 10-01-2003 01:29 AM


All times are GMT -5. The time now is 05:46 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration