anyone know what this means, here is the output of netstat -a

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 black01.black:ssh hamlet.localdomain:4521 ESTABLISHED
tcp 0 0 black01.black:ssh hamlet.localdomain:4431 ESTABLISHED
raw 0 0 *:255 *:* 7
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
unix 5 [ ] DGRAM 2286 /dev/log
unix 2 [ ] DGRAM 2471
unix 2 [ ] DGRAM 2452
unix 2 [ ] DGRAM 2302


specifically the "raw protocol on what looks like port 255 in state 7" what could this be? i am running snort on the box. could that be it?

Try "netstat -ap" and it'll show you the pid/appname.