sockstat / netstat output 8.x vs 7.x



I noticed that apache on RELENG_8 and RELENG_7 shows up with output I cant seem to understand from sockstat -l and netstat -naW

On RELENG_7, sockstat -l makes sense to me
....
www httpd 83005 4 tcp4 *:443 *:*
www httpd 82217 3 tcp4 *:80 *:*
www httpd 82217 4 tcp4 *:443 *:*
www httpd 38942 3 tcp4 *:80 *:*
www httpd 38942 4 tcp4 *:443 *:*
root httpd 1169 3 tcp4 *:80 *:*
root httpd 1169 4 tcp4 *:443 *:*


various processes listening on all bound IP addresses on ports 80 and 443.

On RELENG_8 however, it shows up with an extra entry (at the end)

www httpd 29005 4 tcp4 *:* *:*
www httpd 29004 3 tcp4 6 *:80 *:*
www httpd 29004 4 tcp4 *:* *:*
www httpd 29003 3 tcp4 6 *:80 *:*
www httpd 29003 4 tcp4 *:* *:*
www httpd 66731 3 tcp4 6 *:80 *:*
www httpd 66731 4 tcp4 *:* *:*
root httpd 72197 3 tcp4 6 *:80 *:*
root httpd 72197 4 tcp4 *:* *:*


*:80 makes sense to me... process is listening on all IPs for port 80. What does *:* mean then ?

Netstat gives a slightly different version of it

Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 *.1984 *.* LISTEN
tcp4 0 0 *.* *.* CLOSED
tcp46 0 0 *.80 *.* LISTEN

state closed ?

---Mike



--------------------------------------------------------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike@xxxxxxxxxx
Providing Internet since 1994 www.sentex.net
Cambridge, Ontario Canada www.sentex.net/mike

_______________________________________________
freebsd-stable@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscribe@xxxxxxxxxxx"



Relevant Pages

  • sockstat / netstat output 8.x vs 7.x
    ... I noticed that apache on RELENG_8 and RELENG_7 shows up with output I cant seem to understand from sockstat -l and netstat -naW ... various processes listening on all bound IP addresses on ports 80 and 443. ...
    (freebsd-net)
  • Re: extra open ports in rkhunter
    ... between sockstat and netstat -a. ... Netstat shows an extra 5 ports open, ... Nmap also ...
    (freebsd-questions)
  • extra open ports in rkhunter
    ... I am running rkhunter and it keeps reporting a port inconsistency ... between sockstat and netstat -a. ... Netstat shows an extra 5 ports open, ...
    (freebsd-questions)
  • Re: hacked?
    ... So I ssh'd in and did a netstat and saw what looked like an unwanted SSH connection... ... On the local host type nmap -sV localhost -p 1-65535 to see what ports respond and which apps/services. ...
    (comp.os.linux.misc)
  • Win2k Netstat sockets interpretation
    ... BUT, netstat /a indicates netbios ports 137,138,139,445 listening when I allow ZA to allow T-bird to act as a server to connect to the ... but Akamaitech~ is frequently there and firefox always has 4 connections local and 4 remote open inaddition to the url i am browsing???? ... The output from Ethereal showed a big download in the background from google...hex and what looks like certificates or host file additions to banks .....I no option to control F.F. updates and like to know when/what is updated since permissions and options have a nasty habit of being reset to 'lame' when updates happen silently ...
    (alt.computer.security)