hello, i'm not very up on netstat and its output, so i'd be very glad if someone could tell me whether to worry or not. i'm puzzled to see a lot of connections to :81 in the output. most are closed (about 50) but several appear to be open.
(this is in addition to the five or six www connections one would expect). i was investigating the fact that the admin interface has stopped responding, if that sheds any light. it certainly adds to my anxiety :( portsentry is running, and in quite a paranoid state, but i've never interfered much with (or, indeed, used) the admin interface or port 81. is this bad? er, how bad? thank you. will sample output: tcp 508 0 www.domain.org.uk:81 ncnocm03.telenet-:50366 ESTABLISHED tcp 508 0 www.domain.org.uk:81 ncnocm03.telenet-:48977 ESTABLISHED tcp 511 0 www.domain.org.uk:81 ncnocm03.telenet-:47848 ESTABLISHED tcp 510 0 www.domain.org.uk:81 ncnocm03.telenet-:47440 ESTABLISHED tcp 510 0 www.domain.org.uk:81 ncnocm03.telenet-:47013 ESTABLISHED tcp 510 0 www.domain.org.uk:81 ncnocm03.telenet-:46407 ESTABLISHED tcp 510 0 www.domain.org.uk:81 ncnocm03.telenet-:37713 ESTABLISHED tcp 511 0 www.domain.org.uk:81 ncnocm03.telenet-:29390 ESTABLISHED tcp 394 0 www.domain.org.uk:81 212.2.8.51:1137 CLOSE tcp 404 0 www.domain.org.uk:81 62.253.219.15:39826 CLOSE ...lots... tcp 336 0 www.domain.org.uk:81 61-223-25-98.HINE:64564 CLOSE tcp 579 0 www.domain.org.uk:81 dead.mcc.wwwcache.:4352 CLOSE tcp 532 0 www.domain.org.uk:81 bess-proxy5.hants.:7041 CLOSE tcp 535 0 www.domain.org.uk:81 bess-proxy5.hants.:6146 CLOSE tcp 535 0 www.domain.org.uk:81 bess-proxy5.hants.:2717 CLOSE tcp 0 0 www.domain.org.uk:81 webcacheW03b.cach:16809 ESTABLISHED tcp 0 0 www.domain.org.uk:81 155.109.5.68:44416 ESTABLISHED tcp 0 0 www.domain.org.uk:81 px4so.cg.shawcabl:32176 ESTABLISHED _______________________________________________ cobalt-security mailing list [EMAIL PROTECTED] http://list.cobalt.com/mailman/listinfo/cobalt-security
