2

I never learned network programming and this kind of stuff properly.

Only know very basic stuff like IP address and just a vague concept of what ports and TCP/IP are.

Here, I connected to my lab's server:

enter image description here

and I just got curious about this whole network stuff and tried command netstat

I understand that these are lists of all ports that are on/off on the server.

One thing I don't get is why the 'foreign address' part are shown as 'localhost:xxxxx' and not something like '101.239.49.1' for the ports that are 'ESTABLISHED'

Also could you explain what the 'x11-ssh-offset' means? I'm guessing that this port is used for ssh communication with other computers.

why on earth is it called 'offset'?

P.S. Would be great if you could give me some keywords that would help me get in the right direction to study such issues.

1
  • 3
    That terminal screenshot you used was hard to read, I replaced it with a higher-contrast version. Even better would be to copy and paste it into the question, instead of using a screenshot. You can click the code button {} to typeset it properly.
    – derobert
    Jun 17, 2014 at 17:07

1 Answer 1

3

The part after the colon is the port number, and it's not always displayed as a number since there's a list of well-known ports uses in /etc/services, so you don't have to remember if 22 is ssh or telnet. (The reverse works as well – you can say telnet localhost http and it will understand http as meaning "port 80".) The netstat option --numeric-ports will turn this off.

As to the IPs, it's possible that you've just looked at a point in time where most connections are indeed to your own machine. netstat will do a reverse lookup to determine a more human-friendly name to display, and localhost is usually hardcoded in /etc/hosts as the name for 127.0.0.1. The netstat option --numeric-hosts will turn this off.

1
  • +1 As a note, grep x11-ssh-offset /etc/services will show you that entry. The system can use networking internally, which is why your lab machine has so many localhost <-> localhost connections.
    – goldilocks
    Jun 17, 2014 at 18:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .