Re: Strange connections


Subject: Re: Strange connections
From: Arthur Corliss (arthur@corlissfamily.org)
Date: Tue Aug 13 2002 - 16:53:51 AKDT


> Hi folks,
> When I run netstat -v on one of my solaris servers I come up with 2
> strange connections.
>
> # netstat -v
>
> TCP
> Local/Remote Address Swind Snext Suna Rwind Rnext Rack
> Rto Mss State
> -------------------- ----- -------- -------- ----- -------- --------
> ----- ----- ------
>
> www.evecosoftware.com.1833 32120 9d84923c 9d84923c 10136 8f8eb7fb
> 8f8eb7fb 3455 1448 ESTABLISHED
>
> 202.175.82.64.60379 5840 fa7211c8 fa7211c8 10136 5b46ee6e 5b46ee6e
> 3843 1448 ESTABLISHED
>
> Active UNIX domain sockets
> Address Type Vnode Conn Local Addr Remote Addr
> f5ec7d28 stream-ord f5fe7f20 00000000 /tmp/mysql.sock
> f5ec7e40 stream-ord f5ebb498 00000000 /usr/local/etc/ndc
>
> How can I determine what port they are attached to? How can I kill
> them off of my system?
>
> Any help you can provide is greatly appreciated.

I think you've stripped some of the output from your post. Each connection is
two lines, the first being just one end of the connection, the second being
the other end. For instance, here's a remote connection via rsh:

frigga.1023
heimdal.login 12936 2f382440 2f382440 25872 416b04f7 416b04f7 2473
4312 ESTABLISHED

The port is the number segment at then end of the first field. . .

        --Arthur Corliss
          Bolverk's Lair -- http://arthur.corlissfamily.org/
          Digital Mages -- http://www.digitalmages.com/
          "Live Free or Die, the Only Way to Live" -- NH State Motto

---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.



This archive was generated by hypermail 2a23 : Tue Aug 13 2002 - 17:38:54 AKDT