Port scanning from localhost

Question

I see lot of tcp connections on different ports on my server with 'TIME_WAIT' status. Just simple port scan, but i cant see ip address of this bastard because connections is going from my nginx. Can you please give me a tip how can i see IP address of this bastard?

Here is example:

[root@vh9 ~]# netstat
tcp        0      0 srv:http                    srv:53280                   TIME_WAIT
tcp        0      0 srv:http                    srv:53536                   TIME_WAIT
tcp        0      0 srv:http                    srv:52768                   TIME_WAIT
tcp        0      0 srv:http                    srv:53024                   TIME_WAIT

score 7 · Answer 1 · edited Mar 14 '14 at 12:17

7

This is not a port scan, it's perfectly valid connections from your nginx to apache backend.

edited Mar 14 '14 at 12:17

Andrew Schulman

8,811
21
32
47

answered Nov 10 '12 at 10:25

Maxim Dounin

3,596
19
23

1

No, i haven't any services on this ports. My backend running on 127.0.0.1:80 – Jaels Nov 10 '12 at 10:32
1

These are source ports, they are expected to be random. They are listed in the "Foreign Address" column just because you are looking at backend's side of connections. – Maxim Dounin Nov 10 '12 at 10:40
Hmm, that can be true :) – Jaels Nov 10 '12 at 10:47

Port scanning from localhost

1 Answers1