netstat -- someone connected to my server? http

gian2oo1 · 05-17-2005, 10:33 AM

Hello. I have a server in co-location and my IP is the only IP allowed to access its web server. When I execute "netstat -a" this appears:

tcp 0 0 oscar.com-tec.us:33112 209.94.36.5:http ESTABLISHED

Does this mean that 209.94.36.5 is viewing the web server? My firewall blocks everyone but my IP though (which is 209.113.x.x--far off from 209.94.x.x).

Thanks,

Gian Spicuzza

keefaz · 05-17-2005, 10:38 AM

That means host oscar.com-tec.us is connected with local port TCP 33112
to server 209.94.36.5 with local port TCP 80

So it is the contrary

gian2oo1 · 05-17-2005, 10:45 AM

Oh okay. Thanks.

Nobody is logged-in and this server is used for nightly backups. Is there anyway to kill that connection? "ps aux" doesn't show anything with "links" or a web browser.

Thanks,

Gian

keefaz · 05-17-2005, 10:56 AM

try netstat -ap and kill the pid associed with this connecton, which should appear at the last field

keefaz · 05-17-2005, 11:02 AM

As a note, the IP shown with your netstat output leads me to http://www.clamav.net/
so maybe this connection is caused by a clamav update script or something ?

gian2oo1 · 05-17-2005, 11:49 AM

Quote:

Originally posted by keefaz
As a note, the IP shown with your netstat output leads me to http://www.clamav.net/
so maybe this connection is caused by a clamav update script or something ?

Ahh, yes. I guess I do need that connection

Thanks for clearing that up keefaz!

Thanks again!

Gian