Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I execute a netstat command i see several ip-adresses that have connection to my pc and I don't what they are for. These are the ip's.

 TCP    192.168.1.20:1042      fa-in-f125:5222        HERGESTELLT
 TCP    192.168.1.20:1238      we-in-f100:http        HERGESTELLT
 TCP    192.168.1.20:1281      bru01m01-in-f82:http   HERGESTELLT
 TCP    192.168.1.20:1282      bru01m01-in-f82:http   HERGESTELLT
 TCP    192.168.1.20:1283      bru01m01-in-f82:http   HERGESTELLT
 TCP    192.168.1.20:1284      bru01m01-in-f82:http   HERGESTELLT
 TCP    192.168.1.20:1285      bru01m01-in-f82:http   HERGESTELLT
 TCP    192.168.1.20:1289      bru01m01-in-f138:https  HERGESTELLT
 TCP    192.168.1.20:1294      bru01m01-in-f101:http  HERGESTELLT
 TCP    192.168.1.20:1295      bru01m01-in-f138:http  HERGESTELLT
 TCP    192.168.1.20:1296      bru01m01-in-f101:http  HERGESTELLT
 TCP    192.168.1.20:1297      ww-in-f132:http        HERGESTELLT    
 TCP    192.168.1.20:1298      bru01m01-in-f191:http  HERGESTELLT    
 TCP    192.168.1.20:1299      bru01m01-in-f191:http  HERGESTELLT    
 TCP    192.168.1.20:1300      bru01m01-in-f191:http  HERGESTELLT    
 TCP    192.168.1.20:1301      bru01m01-in-f191:http  HERGESTELLT    
 TCP    192.168.1.20:1302      bru01m01-in-f191:http  HERGESTELLT    
 TCP    192.168.1.20:1303      fra07s07-in-f113:http  HERGESTELLT    
 TCP    192.168.1.20:1304      bru01m01-in-f191:http  HERGESTELLT
 TCP    192.168.1.20:1310      mil01s16-in-f18:http   HERGESTELLT   
 TCP    192.168.1.20:1316      mil01s16-in-f18:http   HERGESTELLT    
 TCP    192.168.1.20:1318      193.247.193.85:https   HERGESTELLT    
 TCP    192.168.1.20:1334      server-216-137-61-177:http  HERGEST    
 TCP    192.168.1.20:1381      46.105.131.100:http    HERGESTELLT    
 TCP    192.168.1.20:1410      87.252.216.36:https    HERGESTELLT    
 TCP    192.168.1.20:1412      87.252.210.40:http     HERGESTELLT    
 TCP    192.168.1.20:1425      mil01s16-in-f18:http   HERGESTELLT

How do I find out if they are malicious, for example a connection opened by a troyaner. And how do I block them?

share|improve this question
    
Do you have any programs that use those ports? –  Ramhound Feb 27 '12 at 18:37
    
I'm not sure about that. –  Luke Feb 27 '12 at 18:52
    
Try netstat -fb from a privileged shell and post the output instead of your current output. The f tells you the full domain, and b the program. –  CodesInChaos Feb 27 '12 at 19:15
    
And if they are indeed malicious, you don't want to block them. You want to find the malicious program and remove it(or just format the computer). –  CodesInChaos Feb 27 '12 at 19:23
    
+1 for CodeInChaos, I suggest you kill all programs which access the internet in a legitimate way before (firefox, piding, thunderbird, etc). The output will be cleared. –  Aki Feb 27 '12 at 19:30
show 1 more comment

closed as off topic by AviD Feb 27 '12 at 21:12

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

Understanding netstat and getting useful information

HERGESTELLT means that there is a connection. Ports that have been opened by server programs on your computer are in state LISTENING (ABHÖREN) instead. Looking at the target ports, this is likely web traffic with the exception of the first one.

In order to get more useful output, you need to use some parameters for netstat as explained in the documentation:

netstat -a -n -o
  • -a will include ports in state LISTENING,
  • -n will show the real ip-addresses instead of the DNS reverse lookup.
  • -o win include the process id (use the Windows Task manager to look it up).

Please keep in mind that in case your computer got infected, you cannot trust the output of netstat as the malicious program might have manipulated it.

Owners of ip-addresses

For the cases in which the IP-address is visible in your log, the owners are as follows:

  • 193.247.193.85: Google
  • 46.105.131.100: Astro Empires is a Massively Multiplayer Online Game
  • 87.252.216.36: Gambling related online games
  • 87.252.210.40: Casino Website

All of them seem to be normal websites, likely not related to trojans.

share|improve this answer
    
-b is nice too. It gives you the name of the executable (unfortunately without path) –  CodesInChaos Feb 27 '12 at 19:58
add comment

Let's look at a line:

TCP 192.168.1.20:1381 46.105.131.100:http HERGESTELLT

I don't speak German, but google search; and matching with my netstat output I believe HERGESTELLT means ESTABLISHED. This means that your local IP (192.168.1.20) on port 1381 has established a TCP connection with (46.105.131.100) via the port typically used for http (port 80). Running a whois on the address gives:

### whois 46.105.131.100        
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '46.105.131.96 - 46.105.131.111'

inetnum:         46.105.131.96 - 46.105.131.111
netname:         Cybertopia
descr:           Astro Empires website
country:         PT
org:             ORG-OL44-RIPE
admin-c:         OTC6-RIPE
tech-c:          OTC6-RIPE
status:          ASSIGNED PA
mnt-by:          OVH-MNT
source:          RIPE # Filtered
[...]

which leads to a website that you (or another user) may legitimately be establishing a connection with. Or they may not.

Note, every time you visit a website you need to establish a connection with it, so you should have benign entries like:

tcp        0      0 192.168.1.120:51127 stackoverflow.com:http   ESTABLISHED

Now you may note several entries like bru01m01-in-f82:http. These are pretty useless as is, since you only have an incomplete part of the host name (bru01m01-in-f82). What you really want to do is run netstat -n (do not resolve names) or netstat --wide (do not truncate resolved host names), so a hostname of iad04s01-in-f83.1e100.net (run by google) is not truncated into a meaningless iad04s01-in-f18.1. (These command line options may vary slightly depending on your particular version of netstat; I gave options of the linux version of netstat that comes with net-tools. The windows netstat command is likely slightly different.)

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.