PDA

View Full Version : What's this netstat result mean?




gauchogolfer
Mar 27, 2006, 09:05 AM
Disclaimer: I have no idea what I'm doing when it comes to using the Terminal.

So, I was interested in what active internet connections I might have going at the moment, what with these discussions of remote vulnerabilities, etc., just to be familiar with what my machine *should* look like under normal circumstances. I saw the terminal command: netstat -a and gave it a whirl. The screenshot is attached.

I'm mainly wondering about the stuff under foreign address like server.untogethe.http .

When this was taken I was connected to the internet via VPN, browsing a couple of sites (including MR of course), using iCal, iTunes, iChat and that's it.

Thanks for the feedback!

Cheers



superwoman
Mar 27, 2006, 12:52 PM
Connections with CLOSE_WAIT states are fine. Those could have been web ads connections that have closed.

Always check for connections with LISTEN states. If there's a active backdoor, this is where it'll show up. Also, try "netstat -an" to see numeric port numbers.

By the way, while you're at the Terminal, "man netstat" will help you understand what you're seeing.