7

I want to know if my server establishes a connection to a remote server or if the remote server tries to reach my server. I tried to read the output of lsof and obtain this information:

lsof -i TCP:25 
 USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
master   2657    root   12u  IPv4     8086      0t0  TCP *:smtp (LISTEN)
smtpd   12950 postfix    6u  IPv4     8086      0t0  TCP *:smtp (LISTEN)
smtpd   12950 postfix    9u  IPv4 35762406      0t0  TCP hostname:smtp->spe.cif.ic.IP:55277 (ESTABLISHED)
smtp    13007 postfix   13u  IPv4 35762309      0t0  TCP hostname:34434->fake.VVVVV.fr:smtp (ESTABLISHED)
smtpd   14188 postfix    6u  IPv4     8086      0t0  TCP *:smtp (LISTEN)
smtpd   14188 postfix    9u  IPv4 35748921      0t0  TCP hostname:smtp->XX.XX.XX.XX:55912 (ESTABLISHED)
smtpd   14897 postfix    6u  IPv4     8086      0t0  TCP *:smtp (LISTEN)

I'd like to know if this information means that my server tries to connect to spe.cif.ic.IP or if it's the other way around.
Is the sign -> relevant, or I should use a different command?

2 Answers 2

10

I think the clue is in the port numbers, take these two entries

smtpd   12950 postfix    9u  IPv4 35762406      0t0  TCP hostname:smtp->spe.cif.ic.IP:55277 (ESTABLISHED)
smtp    13007 postfix   13u  IPv4 35762309      0t0  TCP hostname:34434->fake.VVVVV.fr:smtp (ESTABLISHED)

smtpd has received a connection on port smtp(25) from a high port number, whilst smtp connects to remote port smtp(25) and has a local high port number.

So -> means connected to

1
  • 1
    Should be careful with this. It is convention only. A compromised smtpd could be used to create an outbound connection, forcing the port to 22, to a C&C running on a high port.
    – jrwren
    Mar 17, 2022 at 20:15
10

On Linux at least, lsof can't tell you which end initiated the connection as it gets the list from /proc/net/tcp where that information is not available. The first address always refers to the local endpoint.

Recent versions of the ss utility (which use a different kernel API to retrieve connection information), with -e, will give you direction but unfortunately not for TCP connections.

As @XTian said, for TCP/SCTP/UDP, you can usually guess which it is as the connection initiator will typically use a high port while the destination will typically be a well known low port. There's no guarantee however. Seeing that the machine also has or doesn't have listening sockets on that same port can also confort you in your idea of which direction it is. For instance, in your case, you probably have a process listening on port smtp/25 but none of port unknown/34434. It would be very unlikely that fake.VVVVV.fr would have initiated a connection to port 34434 on your machine especially with a source port 25/smtp (unlikely but perfectly possible).

For something more reliable, you can query the connection tracker.

The system's firewall connection tracker will keep track of what end initiated the connection (or sent the first packet for connection-less transport protocols like UDP). You can query the connection tracking table with the conntrack command-line utility or with the iptstate top-like command.

There, the first address on each line will be that of the one initiating the connection.

Note that it will include all the tracked connections, so possibly also connections forwarded through the system like on routers.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .