Netstat command Help

[Rick Stevens]

On Thu, 2007-08-16 at 22:45 +0100, Paul Ward wrote:
> Hello,
> 
> Can someone explain to me what the netstat command is showing on my server.
> Is mythtv making outgoing connections or are they incoming?
> Is this something to worry about?
> 
> tcp        0      0 mythtv:49189
> 213.red-83-60-5:privatechat ESTABLISHED
> tcp        0     17 mythtv:49189
> 151.125.226.200.in-add:4378 ESTABLISHED
> tcp        0      0 mythtv:49189
> c-75-71-211-38.hsd1.c:vchat ESTABLISHED
> tcp        0      0 mythtv:49189
> dxb-as11957.alshamil:ka0wuc ESTABLISHED
> tcp        0      0 mythtv:49189
> cpc2-stkn3-0-0-cust288:stvp ESTABLISHED
> tcp        0      0 mythtv:35177                151.66.160.74:35024
>      ESTABLISHED
> tcp        0      0 mythtv:49189
> 5ac32ed8.bb.sky.co:rt-event ESTABLISHED
> tcp        0      0 mythtv:56264                mythtv:lds-distrib
>      TIME_WAIT
> tcp        0      0 mythtv:56263                mythtv:lds-distrib
>      TIME_WAIT
> tcp        0   2920 mythtv:49189
> 89-180-44-234.:discp-client ESTABLISHED
> tcp        0      0 mythtv:49189
> static-76-31-224-77:journee ESTABLISHED
> tcp        0      0 mythtv:49189
> c906d4e5.virtua.com.:n1-fwp ESTABLISHED
> tcp        0      0 mythtv:49189
> 201.247.208.1:mkm-discovery ESTABLISHED
> tcp        0      0 mythtv:49189
> eu85-84-181-235.c:metaagent ESTABLISHED
> tcp        0      0 mythtv:46102
> bb-87-80-14-145.ukonl:23491 ESTABLISHED
> tcp        0      0 mythtv:49189
> 81.203.236.21.dyn.use:ff-sm ESTABLISHED
> tcp        0      0 mythtv:49189
> 47.red-81-41:spw-dnspreload ESTABLISHED
> tcp        0      0 mythtv:49189
> acd15a0f.ipt.aol.com:57607  ESTABLISHED
> tcp        0      0 mythtv:49189
> 196.211.12.74:slc-systemlog ESTABLISHED
> tcp        0      0 mythtv:49189
> 201-254-170-207.speedy:msmq ESTABLISHED
> tcp        0      0 mythtv:49189
> a88-114-123-113.elisa:61136 ESTABLISHED
> tcp        0      0 mythtv:49189
> r190-64-194-173.dialup:3977 ESTABLISHED
> tcp        0      0 mythtv:49189
> 116.46.rev.vline:valisys-lm ESTABLISHED

Sure looks like you got hacked.  Someone's running a server on your
machine that a lot of people are connected to.  It's listening on
port 49189, so do a "netstat -lpn" and find which process that is and
KILL THE DAMNED THING.  You'd better do a rootkit scan while you're
at it.

----------------------------------------------------------------------
- Rick Stevens, Principal Engineer             rstevens at internap.com -
- CDN Systems, Internap, Inc.                http://www.internap.com -
-                                                                    -
-             To iterate is human, to recurse, divine.               -
----------------------------------------------------------------------