Mysterious connections from 0.0.0.0

LifeSteala

• August 24, 2020 18:21

Hi I'm not sure if this is the right forum but I ran this netstat command to see a list of IP connections of my server. There's a bunch of 1 connected IPs which I removed but I am seeing 54 connections from 0.0.0.0. I've not seen this before. Does anyone know what 0.0.0.0 is? [root@server01 ~]# netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n 1 BUNCH OF IPs 9 127.0.0.1 25 27 IP HERE 54 0.0.0.0

• 

  andrew.n

  • August 25, 2020 18:45

  0.0.0.0 is local connection. Do you know what is the port? My guess would be MySQL or something like that.

  0
• 

  cPanelLauren

  • August 27, 2020 17:13

  This wouldn't have just one port assignment. Local services connect over a port with 0.0.0.0 for internal connections. For example on my test server: [root@server logs]# netstat -anp |grep '0.0.0.0' |awk '{print $4, $7}' |cut -d: -f2 |sort |uniq -c |sort -n 1 110 3623/dovecot 1 111 1 111 502/rpcbind 1 11211 1432/memcached 1 143 3623/dovecot 1 2077 33810/cpdavd 1 2078 33810/cpdavd 1 2082 1975/cpsrvd 1 2083 1975/cpsrvd 1 2086 1975/cpsrvd 1 2087 1975/cpsrvd 1 2095 1975/cpsrvd 1 2096 1975/cpsrvd 1 21 1436/pure-ftpd 1 22 1445/sshd 1 25 24623/exim 1 443 20721/httpd 1 465 24623/exim 1 52223 4927/im360 1 52224 4927/im360 1 52227 4927/im360 1 52228 4927/im360 1 52229 4927/im360 1 52230 4927/im360 1 52231 4927/im360 1 52232 4927/im360 1 53 1 53 1410/pdns_server 1 587 24623/exim 1 62311 33912/CalendarServe 1 676 1 783 3584/spamd 1 80 20721/httpd 1 953 1410/pdns_server 1 993 3623/dovecot 1 995 3623/dovecot 2 5432 33708/postgres 4 123
  

  0

Please sign in to leave a comment.