Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

When I execute a netstat command i see several ip-adresses that have connection to my pc and I don't what they are for. These are the ip's.

 TCP      fa-in-f125:5222        HERGESTELLT
 TCP      we-in-f100:http        HERGESTELLT
 TCP      bru01m01-in-f82:http   HERGESTELLT
 TCP      bru01m01-in-f82:http   HERGESTELLT
 TCP      bru01m01-in-f82:http   HERGESTELLT
 TCP      bru01m01-in-f82:http   HERGESTELLT
 TCP      bru01m01-in-f82:http   HERGESTELLT
 TCP      bru01m01-in-f138:https  HERGESTELLT
 TCP      bru01m01-in-f101:http  HERGESTELLT
 TCP      bru01m01-in-f138:http  HERGESTELLT
 TCP      bru01m01-in-f101:http  HERGESTELLT
 TCP      ww-in-f132:http        HERGESTELLT    
 TCP      bru01m01-in-f191:http  HERGESTELLT    
 TCP      bru01m01-in-f191:http  HERGESTELLT    
 TCP      bru01m01-in-f191:http  HERGESTELLT    
 TCP      bru01m01-in-f191:http  HERGESTELLT    
 TCP      bru01m01-in-f191:http  HERGESTELLT    
 TCP      fra07s07-in-f113:http  HERGESTELLT    
 TCP      bru01m01-in-f191:http  HERGESTELLT
 TCP      mil01s16-in-f18:http   HERGESTELLT   
 TCP      mil01s16-in-f18:http   HERGESTELLT    
 TCP      server-216-137-61-177:http  HERGEST    
 TCP      mil01s16-in-f18:http   HERGESTELLT

How do I find out if they are malicious, for example a connection opened by a troyaner. And how do I block them?

share|improve this question

closed as off topic by AviD Feb 27 '12 at 21:12

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.

Do you have any programs that use those ports? –  Ramhound Feb 27 '12 at 18:37
I'm not sure about that. –  Luke Feb 27 '12 at 18:52
Try netstat -fb from a privileged shell and post the output instead of your current output. The f tells you the full domain, and b the program. –  CodesInChaos Feb 27 '12 at 19:15
And if they are indeed malicious, you don't want to block them. You want to find the malicious program and remove it(or just format the computer). –  CodesInChaos Feb 27 '12 at 19:23
+1 for CodeInChaos, I suggest you kill all programs which access the internet in a legitimate way before (firefox, piding, thunderbird, etc). The output will be cleared. –  Aki Feb 27 '12 at 19:30

2 Answers 2

Understanding netstat and getting useful information

HERGESTELLT means that there is a connection. Ports that have been opened by server programs on your computer are in state LISTENING (ABHÖREN) instead. Looking at the target ports, this is likely web traffic with the exception of the first one.

In order to get more useful output, you need to use some parameters for netstat as explained in the documentation:

netstat -a -n -o
  • -a will include ports in state LISTENING,
  • -n will show the real ip-addresses instead of the DNS reverse lookup.
  • -o win include the process id (use the Windows Task manager to look it up).

Please keep in mind that in case your computer got infected, you cannot trust the output of netstat as the malicious program might have manipulated it.

Owners of ip-addresses

For the cases in which the IP-address is visible in your log, the owners are as follows:

  • Google
  • Astro Empires is a Massively Multiplayer Online Game
  • Gambling related online games
  • Casino Website

All of them seem to be normal websites, likely not related to trojans.

share|improve this answer
-b is nice too. It gives you the name of the executable (unfortunately without path) –  CodesInChaos Feb 27 '12 at 19:58

Let's look at a line:


I don't speak German, but google search; and matching with my netstat output I believe HERGESTELLT means ESTABLISHED. This means that your local IP ( on port 1381 has established a TCP connection with ( via the port typically used for http (port 80). Running a whois on the address gives:

### whois        
% This is the RIPE Database query service.
% The objects are in RPSL format.
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to ' -'

inetnum: -
netname:         Cybertopia
descr:           Astro Empires website
country:         PT
org:             ORG-OL44-RIPE
admin-c:         OTC6-RIPE
tech-c:          OTC6-RIPE
status:          ASSIGNED PA
mnt-by:          OVH-MNT
source:          RIPE # Filtered

which leads to a website that you (or another user) may legitimately be establishing a connection with. Or they may not.

Note, every time you visit a website you need to establish a connection with it, so you should have benign entries like:

tcp        0      0 stackoverflow.com:http   ESTABLISHED

Now you may note several entries like bru01m01-in-f82:http. These are pretty useless as is, since you only have an incomplete part of the host name (bru01m01-in-f82). What you really want to do is run netstat -n (do not resolve names) or netstat --wide (do not truncate resolved host names), so a hostname of iad04s01-in-f83.1e100.net (run by google) is not truncated into a meaningless iad04s01-in-f18.1. (These command line options may vary slightly depending on your particular version of netstat; I gave options of the linux version of netstat that comes with net-tools. The windows netstat command is likely slightly different.)

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.