LinuxQuestions.org
Go Job Hunting at the LQ Job Marketplace
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 11-16-2004, 10:53 AM   #1
JaseP
Senior Member
 
Registered: Jun 2002
Location: Eastern PA, USA
Distribution: K/Ubuntu 10.04/12.04, Scientific Linux 6.3, Android-x86, Maemo
Posts: 1,658

Rep: Reputation: 138Reputation: 138
Question about netstat results


I have a question about netstat results...

when I do a netstat -tavn, I get the following (my orinating IP addresses removed, irrelevant info snipped out):

Code:
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
...snip...
tcp        0      0 xxx.xxx.xxx.xxx:xxxx    140.221.9.138:56581     ESTABLISHED
tcp        0      0 xxx.xxx.xxx.xxx:xxxx    140.221.9.138:21        ESTABLISHED
tcp        0      0 xxx.xxx.xxx.xx:xxxx     xxx.xxx.xx.xxx:80       TIME_WAIT
...snip...
IP address 140.221.9.128 belongs to the Argonne National Laboratory in Illinois...
Why would my machine be connecting to it???
 
Old 11-16-2004, 11:28 AM   #2
slacky
Member
 
Registered: Feb 2004
Location: USA
Distribution: Debian
Posts: 174

Rep: Reputation: 16
If you add the -p option to netstat - it will show the program name being used. Although that host appears to be a Linux Distro Mirror (http://alpaca.mcs.anl.gov/) - could you be running a update program that is configured to use that host as an FTP mirror?
 
Old 11-16-2004, 11:36 AM   #3
JaseP
Senior Member
 
Registered: Jun 2002
Location: Eastern PA, USA
Distribution: K/Ubuntu 10.04/12.04, Scientific Linux 6.3, Android-x86, Maemo
Posts: 1,658

Original Poster
Rep: Reputation: 138Reputation: 138
Yep, it's the online update...

I wonder,... is there any way to deactivate online update??? It's set to manual anyway.
 
Old 11-16-2004, 12:52 PM   #4
bignerd
Member
 
Registered: Nov 2004
Distribution: FC1, Gentoo, Mdk 8.1, RH7-8-9, Knoppix, Zuarus rom 3.13
Posts: 98

Rep: Reputation: 15
Quote:
Originally posted by JaseP
Yep, it's the online update...

I wonder,... is there any way to deactivate online update??? It's set to manual anyway.
If it's on then it's running as a service (daemon). Soooo... check your services.

chkconfig --list is an easy way. Just look down the services started for the runlevel you are in.

-b

'man chkconfig' is your friend.
 
Old 11-18-2004, 12:09 PM   #5
JaseP
Senior Member
 
Registered: Jun 2002
Location: Eastern PA, USA
Distribution: K/Ubuntu 10.04/12.04, Scientific Linux 6.3, Android-x86, Maemo
Posts: 1,658

Original Poster
Rep: Reputation: 138Reputation: 138
Thanks.

I usually don't like messing with the running services, but If I see it, I might try to kill it, especially if it is eating CPU cycles...
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How can i limit the netstat local results on fedora core 3 vtecturbo13 Linux - General 2 10-11-2005 03:21 PM
Netstat results. Imyrryr Linux - Networking 2 07-02-2004 10:00 PM
Weird results with netstat nekromancer Linux - Networking 3 02-17-2004 01:36 AM
netstat question digsby0007 Linux - Networking 1 12-27-2003 05:33 PM
re: security and results of netstat probe ergo_sum Linux - Newbie 5 11-15-2003 06:34 PM


All times are GMT -5. The time now is 12:53 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration