Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Scaricare il pdf (Pagina 53)

tcp 0 1 169.254.179.139:1175 64.152.100.93:119 SYN_SENT

tcp 0 1 169.254.179.139:1173 64.152.100.93:119 SYN_SENT

tcp 0 0 169.254.179.139:1172 207.153.203.114:80 ESTABLISHED

tcp 1 0 169.254.179.139:1199 216.26.129.136:80 CLOSE_WAIT

tcp 0 0 169.254.179.139:80 63.236.92.144:34197 TIME_WAIT

tcp 400 0 127.0.0.1:1152 127.0.0.1:8000 CLOSE_WAIT

tcp 6648 0 127.0.0.1:1162 127.0.0.1:8000 CLOSE_WAIT

tcp 553 0 127.0.0.1:1164 127.0.0.1:8000 CLOSE_WAIT

udp 0 0 0.0.0.0:32768 0.0.0.0:*

udp 0 0 192.168.1.1:53 0.0.0.0:*

udp 0 0 127.0.0.1:53 0.0.0.0:*

udp 0 0 0.0.0.0:631 0.0.0.0:*

Let's look at the first few lines of this in detail. On line one,

tcp 0 0 0.0.0.0:515 0.0.0.0:* LISTEN

"Local Address" is 0.0.0.0, meaning "all" interfaces that are available. The local port is 515, or the

standard print server port, usually owned by the lpd daemon. You can find a listing of common service names

and corresponding ports in the file /etc/services.

The fact that it is listening on all interfaces is significant. In this case, that would be lo (localhost), eth0, and

eth1. Printer connections could conceivably be made over any of these interfaces. Should a user on this

system bring up a PPP connection, then the print daemon would be listening on that interface (ppp0) as well.

The "Foreign Address" is also 0.0.0.0, meaning from "anywhere".

It is also worth noting here, that even though this server is telling the kernel to listen on all interfaces, the

netstat output does not reflect whether there may be a firewall in place that may be filtering incoming

connections. We just can't tell that at this point. Obviously, for certain servers, this is very desirable. Nobody

outside your own LAN has any reason whatsoever to connect to your print server port for instance.

Line two is a little different:

tcp 0 0 127.0.0.1:8000 0.0.0.0:* LISTEN

Notice the "Local Address" this time is localhost's address of 127.0.0.1. This is very significant as only

connections local to this machine will be accepted. So only bigcat can connect to bigcat's TCP port 8000. The

security implications should be obvious. Not all servers have configuration options that allow this kind of

restriction, but it is a very useful feature for those that do. Port 8000 in this example, is owned by the web

proxy Junkbuster.

With the next three entries, we are back to listening on all available interfaces:

tcp 0 0 0.0.0.0:37 0.0.0.0:* LISTEN

tcp 0 0 0.0.0.0:6000 0.0.0.0:* LISTEN

tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN

Security Quick−Start HOWTO for Red Hat Linux

8.3. Netstat Tutorial 50

Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Pagina 53