Re: strange outbound connection

[Justin Guerin <jguerin@cso.atmel.com>]

On Tuesday 17 January 2006 07:46, johannes wrote:
> Sarunas Burdulis wrote:
> >>The firewall (firestrarter gui to be precise), just shows a line in
> >>active connections (ie. NOT in blocked connections) with an 'unknown
> >>service' on port 1056 to that external host. I'm just wondering how
> >>firestarter knows about this connection.
> >>
> >>I don't know how to proceed. Maybe it's just a bug in firestarter to be
> >>ignored?
> >
> > What about `lsof -i`?
>
> nothing:
> llserv:~# lsof -i @217.91.13.234
> llserv:~# lsof -i @213.20.165.177
>
> (I now have two of them, according to firestarter listening on different
> ports: 1054 and 33414)
>
> > Sarunas Burdulis
>
> Johannes

If you're worried that you've got a service running that you don't want, 
try, as root, 'lsof | grep LISTEN'.  This will show you all programs that 
are actively listening for connections, even if they're bound to the local 
host.

If that doesn't solve the mystery, how about the output of, as root, 'lsof | 
egrep "TCP|UDP"'?  That will show you some established network connections 
(mounts are missing for me), and the program responsible.  I don't know if 
anything will show up here that doesn't show up in 'netstat --ip', though.

Hopefully, one of those will point you in the right direction.

Justin Guerin