Question about netstat results

JaseP · 11-16-2004, 10:53 AM

I have a question about netstat results...

when I do a netstat -tavn, I get the following (my orinating IP addresses removed, irrelevant info snipped out):

Code:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
...snip...
tcp        0      0 xxx.xxx.xxx.xxx:xxxx    140.221.9.138:56581     ESTABLISHED
tcp        0      0 xxx.xxx.xxx.xxx:xxxx    140.221.9.138:21        ESTABLISHED
tcp        0      0 xxx.xxx.xxx.xx:xxxx     xxx.xxx.xx.xxx:80       TIME_WAIT
...snip...

IP address 140.221.9.128 belongs to the Argonne National Laboratory in Illinois...
Why would my machine be connecting to it???

slacky · 11-16-2004, 11:28 AM

If you add the -p option to netstat - it will show the program name being used. Although that host appears to be a Linux Distro Mirror (http://alpaca.mcs.anl.gov/) - could you be running a update program that is configured to use that host as an FTP mirror?

JaseP · 11-16-2004, 11:36 AM

Yep, it's the online update...

I wonder,... is there any way to deactivate online update??? It's set to manual anyway.

bignerd · 11-16-2004, 12:52 PM

Quote:

Originally posted by JaseP
Yep, it's the online update...

I wonder,... is there any way to deactivate online update??? It's set to manual anyway.

If it's on then it's running as a service (daemon). Soooo... check your services.

chkconfig --list is an easy way. Just look down the services started for the runlevel you are in.

-b

'man chkconfig' is your friend.

JaseP · 11-18-2004, 12:09 PM

Thanks.

I usually don't like messing with the running services, but If I see it, I might try to kill it, especially if it is eating CPU cycles...