Hosting Provided By

Re: netstat shows strange output

From: Noah Meyerhans <noahm(at)debian.org>
Date: Sun Jan 06 2008 - 14:56:15 EST

On Sun, Jan 06, 2008 at 01:36:26PM -0600, William Twomey wrote:
>
> I also disabled ipv6, which I was seeing a lot of from this host.

Probably not, unless you've knowingly configured IPv6 routing and all that; you were probably seeing a lot of IPv4 mapped v6 addresses, which look (in netstat) like ::ffff:66.116.125.131. [1] Disabling v6 is an entirely reasonable thing to do if you don't use it, but is probably not going to do anything about the actual traffic.

> tcp 0 0 192.168.1.240:www ba.2c.5646.static:55674
> FIN_WAIT2
> tcp 1 0 192.168.1.240:www ba.2c.5646.static:44413
> CLOSE_WAIT
> tcp 0 0 192.168.1.240:www ba.2c.5646.static:59517
> ESTABLISHED
> tcp 1 0 192.168.1.240:www ba.2c.5646.static:44401
> CLOSE_WAIT
>
> I've blocked this IP (resolves to 18255.com) on this machine using
> iptables -I INPUT -s 66.116.125.131 -j DROP
>
> This doesn't work, so perhaps it's a spoofed IP? *shrugs*
>
> Any help would be appreciated, this is causing a bit of strain on my web
> server. :/

Dropping packets from a host won't magically make all open connections from that host go away. These connections will eventually time out and go away. Until then, unless your web server is *really* resource-starved, these connections aren't causing any significant strain.

You should probably read the netstat man page and RFC 793 [2] for info about what those various states mean. For example, a connection in FIN_WAIT2 state is waiting for a packet from the remote host, which you've explicitly forbidden.

noah

[1] http://en.wikipedia.org/wiki/IPv4_mapped_address [2] http://nwww.faqs.org/rfcs/rfc793.html

-- 
To UNSUBSCRIBE, email to debian-security-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org


application/pgp-signature attachment: Digital signature

Received on Sun Jan 6 15:23:50 2008

Do you need help?

This message: [ Message body ]
Next message: Nihil: "Re: [SECURITY] [DSA 1447-1] New tomcat5.5 packages fix several vulnerabilities"
Previous message: William Twomey: "netstat shows strange output"
In reply to: William Twomey: "netstat shows strange output"
Next in thread: Bernd Eckenfels: "Re: netstat shows strange output"

Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ] [ By messages with attachments ]

This archive was generated by hypermail 2.1.8 : Wed Mar 19 2008 - 06:55:01 EDT