Security: question about my netstat output

[javathecat]

Hi all,

Just last night I was spending a bit of time trying to start learning a bit about how to be confident that my system is secure, as you know you don't do this sort of thing just in a day. But anyway I was in the process of learning about my ports and sockets and how to check which ones are open or not.

After reading about it briefly I typed in the command 'netstat' and got the following output:

$netstat

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 nailz-desktop.loc:34978 www.kubuntu.org:www TIME_WAIT
tcp6 0 0 192.168.1.100%134:42017 cpe-75-83-58-21.so:2016 CLOSE_WAIT
tcp6 0 0 192.168.1.100%134:34823 c-69-251-123-154.:16099 ESTABLISHED
tcp6 0 0 192.168.1.100%134:42016 cpe:2016 CLOSE_WAIT
tcp6 0 0 192.168.1.100%134:48906 97.102.193.107%81:13870 ESTABLISHED
tcp6 0 0 192.168.1.100%134:37049 96-39-172-123.dhc:29270 ESTABLISHED
tcp6 0 0 192.168.1.100%134:58095 75-163-152-54.cls:34055 ESTABLISHED
tcp6 1 0 192.168.1.100%134:47521 v001.nuspace.net:www CLOSE_WAIT
tcp6 0 0 192.168.1.100%134:46897 c-98-235-20-169.h:19855 ESTABLISHED

Anyway I was a bit suspicious about this one...
v001.nuspace.net:www (Should this be there?)

It just brings me to the question of what connections should and should not be there?

This is a bit of an open-ended question, but I was just wondering if anyone else is able to give me any comments on this?

Cheers

[Snowhog]

Re: Security: question about my netstat output

In part, it appears to be a DNS server. It also seems to be used by Googlemail.

[javathecat]

Re: Security: question about my netstat output

Yes, and the natural question for this being that they have a port open on my puter because?

>

I found this:
http://www.robtex.com/dns/v001.nuspace.net.html ...etc

Am I just being paranoid about this? Or is there a reasonable explanation?
I don't use Gmail.

Thanks for confirming BTW, but this is interesting and I want to get to the bottom of it.

Is there anyone else I could ask about this?

[Snowhog]

Re: Security: question about my netstat output

The link you cite is the one I came across as well. I've no information as to why it appears in your netstat results.

[kubicle]

Re: Security: question about my netstat output

Have you visited www.frostwire.com recently?

See the first entry in http://www.robtex.com/dns/www.frostwire.com.html

Normal Internet traffic will create a lot of connections like this in netstat output, and are usually not a concern (the connection stays in netstat for a short while after the connection is made...marked as CLOSE_WAIT "waiting to close socket")

[javathecat]

Re: Security: question about my netstat output

Yes I think you're probably right,

it was just quite intriguing to see something like that for the first time and I was a little curious about it's nature. Especially when I saw the robtex site.

Is is appropriate to ask what the story with that is? I've never seen anything like that before.

[kubicle]

Re: Security: question about my netstat output

Is is appropriate to ask what the story with that is? I've never seen anything like that before.

what's the story with robtex?

It's just a site that queries host information on the internet (and it isn't the only one)

There are also a number of command line tools you can use to get the same information (like host, whois, traceroute or tracepath, ping .etc...though not all of them are installed by default, as I recall)

[Detonate]

Re: Security: question about my netstat output

Try gnome-nettool.