Do you have a question? Post it now! No Registration Necessary. Now with pictures!
- Posted on
- netstat question
May 22, 2006, 6:35 pm
rate this thread
Upon issuing the netstat -t command, I find some lines with the
Foreign Address listing an unknown IP with the State ESTABLISHED (tcp).
After googling and reading the man page for netstat, I'm still unsure
as to what precisely this means other than there is an established
connection. I suppose what I need is to know are these connections a
security risk? And if so, how do I stop them?
Re: netstat question
More often than not, these have been network services (web sites etc) that
have been used by the local user. Including at least port numbers (and
indicating which port number is on local address and which is on remote
address) would do a lot in determining what is going on.
It could also be that the machine has been cracked, and is used for
malicious purposes. But as said, with just the information that there
are connections, it is impossible to make any educated guesses.
If the machine has been cracked, it'll be _very hard_ to be able to
establish trust on the system without doing a complete re-install.
On a cracked system, any part of the system may be set up as an additional
back door (or intelligence gathering service - such as keyboard snooper).
Wolf a.k.a. Juha Laiho Espoo, Finland
(GC 3.0) GIT d- s+: a C++ ULSH++++$ P++@ L+++ E- W+$@ N++ !K w !O !M V
PS(+) PE Y+ PGP(+) t- 5 !X R !tv b+ !DI D G e+ h---- r+++ y++++
"...cancel my subscription to the resurrection!" (Jim Morrison)
- » HPSBUX02120 SSRT051057 rev.1 - HP-UX Local Denial of Service (DoS)
- — Previous thread in » General Computer Security