This concerns me, from the netstat output:
tcp 0 0 64.22.124.56:58564 91.121.14.55:8080 ESTABLISHED
91.121.14.55 figures prominently in the tcpdump as well... is that IP known to you? Does your server have any reason to be contacting it on port 8080? If not, I suspect shenanigans.
On the netstat, I should have had you do:
netstat -nutawp
(Must be run as root)
That adds a column for the process that owns a connection:
Code:
rtucker@arrogant-bastard:~$ sudo netstat -nutawp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 192.168.1.12:51873 74.125.91.109:993 ESTABLISHED 30002/evolution
In this case, I know process 30002 is connecting to 74.125.91.109:993 and -- if I wasn't expecting that -- I'd know where to investigate further.
If you have lsof installed, by the way, you can do something like:
lsof -p30002
... and it'll tell you everything that pid 30002 has open. This will be a startlingly long list (it's 358 lines for that pid on my system!), but it can be valuable information when trying to figure out what, exactly, is going on.
FAQ
Search
Members
Register
Login [ Anonymous ]
