4

I want to know if my server establishes a connection to a remote server or if the remote server tries to reach my server. I tried to read the output of lsof and obtain this information:

lsof -i TCP:25 
 USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
master   2657    root   12u  IPv4     8086      0t0  TCP *:smtp (LISTEN)
smtpd   12950 postfix    6u  IPv4     8086      0t0  TCP *:smtp (LISTEN)
smtpd   12950 postfix    9u  IPv4 35762406      0t0  TCP hostname:smtp->spe.cif.ic.IP:55277 (ESTABLISHED)
smtp    13007 postfix   13u  IPv4 35762309      0t0  TCP hostname:34434->fake.VVVVV.fr:smtp (ESTABLISHED)
smtpd   14188 postfix    6u  IPv4     8086      0t0  TCP *:smtp (LISTEN)
smtpd   14188 postfix    9u  IPv4 35748921      0t0  TCP hostname:smtp->XX.XX.XX.XX:55912 (ESTABLISHED)
smtpd   14897 postfix    6u  IPv4     8086      0t0  TCP *:smtp (LISTEN)

I'd like to know if this information means that my server tries to connect to spe.cif.ic.IP or if it's the other way around.
Is the sign -> relevant, or I should use a different command?

| improve this question | | | | |
8

I think the clue is in the port numbers, take these two entries

smtpd   12950 postfix    9u  IPv4 35762406      0t0  TCP hostname:smtp->spe.cif.ic.IP:55277 (ESTABLISHED)
smtp    13007 postfix   13u  IPv4 35762309      0t0  TCP hostname:34434->fake.VVVVV.fr:smtp (ESTABLISHED)

smtpd has received a connection on port smtp(25) from a high port number, whilst smtp connects to remote port smtp(25) and has a local high port number.

So -> means connected to

| improve this answer | | | | |
7

On Linux at least, lsof can't tell you which end initiated the connection as it gets the list from /proc/net/tcp where that information is not available. The first address always refers to the local endpoint.

Recent versions of the ss utility (which use a different kernel API to retrieve connection information), with -e, will give you direction but unfortunately not for TCP connections.

As @XTian said, for TCP/SCTP/UDP, you can usually guess which it is as the connection initiator will typically use a high port while the destination will typically be a well known low port. There's no guarantee however. Seeing that the machine also has or doesn't have listening sockets on that same port can also confort you in your idea of which direction it is. For instance, in your case, you probably have a process listening on port smtp/25 but none of port unknown/34434. It would be very unlikely that fake.VVVVV.fr would have initiated a connection to port 34434 on your machine especially with a source port 25/smtp (unlikely but perfectly possible).

For something more reliable, you can query the connection tracker.

The system's firewall connection tracker will keep track of what end initiated the connection (or sent the first packet for connection-less transport protocols like UDP). You can query the connection tracking table with the conntrack command-line utility or with the iptstate top-like command.

There, the first address on each line will be that of the one initiating the connection.

Note that it will include all the tracked connections, so possibly also connections forwarded through the system like on routers.

| improve this answer | | | | |
  • very precise as usual :) Thanks for the precision. – Kiwy Jun 24 '15 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.