Output of sudo watch lsof -i and sudo watch netstat -tp show ESTABLISHED connections with unresolvable domain (e.g., host, dig woldn't resolve, trying to access domain directly via URL from firefox would show "Server not found") on https . Opened sockets for these connections belong to firefox. What could this mean?

  • If you are talking about an hypothetical troublesome output, it would be better providing it for people to judge. Otherwise, you will just have answers here confirming your biased observations. You are also not clear wether you were using Firefox or not, or if you have sites in your server, or what machine you are even talking about. malware? normal use? who knows. – Rui F Ribeiro Feb 3 '18 at 17:12
  • @RuiFRibeiro an example would help, I agree. But as for the other points in your comment I don't think it matters whether the connection is legitmate or malware, known or unknown. Firefox is relevant here only as a generator of outgoing connections to web servers. IMO of course. – roaima Feb 3 '18 at 17:23

Both these tools use rDNS to look up names from IP addresses. By convention forward and reverse DNS should match but in some cases (for example a server hosting many different websites) it may not make sense.

Consider a website somesite.contoso.com, to which you connect with Firefox or some other browser. It has an IP address, which has an rDNS entry pointing back to server57.example.net. You might not find an A record in the DNS for server57.example.net but you would find somesite.contoso.com and possibly even web.example.org both with a forward mapping to

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.