Netstat results from terminal

[mckegan]

Hey everyone I was wondering if you could take a look at my netstat that I ran... back to back with two totally amounts of IP addresses... Just thought it should be always one or always the other? Any advice/ criticism greatly appreciated.

mikes-computer:/ Michael$ netstat -nat | sed -n -e '/ESTABLISHED/p' | awk '{print $5}' | sed 's/\./ /g' | awk '{print $1"."$2"."$3"."$4}' | sort

17.110.228.89

216.58.216.170

216.58.217.193

216.58.217.206

216.58.217.206

216.58.217.206

216.58.217.206

216.58.217.206

216.58.217.206

216.58.217.206

216.58.217.206

216.58.219.33

216.58.219.34

216.58.219.34

216.58.219.34

216.58.219.34

216.58.219.34

216.58.219.34

216.58.219.34

216.58.219.34

216.58.219.34

216.58.219.35

216.58.219.35

216.58.219.35

216.58.219.35

216.58.219.35

216.58.219.35

216.58.219.35

216.58.219.35

216.58.219.35

216.58.219.38

216.58.219.38

216.58.219.38

216.58.219.41

216.58.219.41

74.125.20.108

74.125.20.109

74.125.20.109

74.125.20.109

74.125.20.94

74.125.25.95

mikes-computer:/ Michael$ netstat -nat | sed -n -e '/ESTABLISHED/p' | awk '{print $5}' | sed 's/\./ /g' | awk '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -n

1 17.110.228.89

1 74.125.20.108

3 74.125.20.109

mikes-computer:/ Michael$ netstat -nat | sed -n -e '/ESTABLISHED/p' | awk '{print $5}' | sed 's/\./ /g' | awk '{print $1"."$2"."$3"."$4}' | sort

141.101.120.14

17.110.228.89

216.58.216.170

216.58.216.170

216.58.216.170

216.58.216.170

216.58.217.196

216.58.219.34

74.125.20.108

74.125.20.109

74.125.20.109

74.125.20.109

74.125.20.120

74.125.20.120

 

[hiddenmarkov]

They have several DNS systems in place. traditionally you'd see one or 2...can be more though.


You'd see only 1 or 2 if you went full static and specified the DNS servers in that process. Usually its just your primary and secondary. Downside being if both down or unreachable...face meet wall. Unless you know your destination's IP address already anyway.


You may also want to run netstat with more options to see processes making the connections. If you have applications that know exactly where they need to go, they can go there directly. the 216 (edited 216)'s I'd say are requests to your ISP's DNS. The 74's....offhand may be an application or process knowing where it needs to go and skipping the requests to 216. Or are you running some VPN/tunneling? My netstat would show differently when using my vpn as it routes through the services DNS to make a US endpoint all happy. Its when requests come in from Japanese DNS I get the sorry buy your region is not supported issues.