See who is connected to your server

Sometimes it is a good idea to examine which ports are open on your server and often you like to know how many are connected to you server, and who they are. This is possible with the tool netstat which is avaible on almost all Linux distros. The syntax varies from distro to distro, the version I use is the one provided by Debian.
Just use the following command.

netstat –ant

An example of the output can be seen here.

Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp6       0      0 :::22                   :::*                    LISTEN
tcp        0      0 127.0.0.1:7634          0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:3306          127.0.0.1:53504         ESTABLISHED
tcp6       0      0 10.0.0.3:80             1.2.3.4:2394       ESTABLISHED 

The first line shows that the server is listening on port 22. This is show by the state column. The local address shows that the listen is not binded to a specific network interface. If it was bound to a specific NIC, then the IP address would be stated.

The second line shows that the server listens on port 7634, but only on localhost (127.0.0.1). This means that the service is not reachable from outside the server.

Line 3 show that a connection to a service on port 3306 is established. The foriegn address column tells who is connected, and on which port the communication will be done. This shows that it is a local connection from within the server itself.

Line 4 shows that IP 1.2.3.4 is connected to port 80 on the 10.0.0.3 interface.

Leave a Reply