netstat: PC Tips by Anu

Showing posts with label netstat. Show all posts

Sunday, September 12, 2010

LINUX : How to find out that " Who listen on a specific port?"?

Sunday, September 12, 2010

Anu

Tracking down your network daemons is extremely easy if you use the right tools.

Last week a reader asked the following question:

"I'm having trouble tracking down a process that'srunning on my machine. When I run netstat -a, I see lots of things thatshould be there, but also the following:

$ netstat -a
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address    Foreign Address   State
tcp        0      0 localhost:imaps *:*               LISTEN
tcp        0      0 *:smtp           *:*               LISTEN
...
tcp        0      0 *:8577           *:*               LISTEN
...

I can't figure out what that is on port 8577. Any ideas?"

My first reaction is almost universally to connect and see if it says anything useful. So I had him pull out netcat[1] to check the header:

$ nc localhost 8577
RFB 003.003

The server process responded with the RFB line. That's what you get when you connect to a VNC server, just like you'd expect SSH-1.99-OpenSSH.... for an SSH server that supports v1 and v2.

Most network daemons will say something when you connect. You can usually match the output (aka the banner) to a protocol or process.

However there are two other ways that are even more direct, that can tie the network port to the actual process that is listening. For example on the machine running the VNC server on port 8577, there was no process called vncserver running on the machine.

So, we turn to two tools: netstat, and our old friend lsof.

Netstat has a -p option that will show you the name and pid (process id) of the local process that is associated with a connection.
If you're running as root, you can see the processes for all users. If you're a normal user, you can only see the processes that are running as you.

So, re-running the netstat above with -p would have yielded

# netstat -ap
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address    Foreign Address   State
tcp        0      0 localhost:imaps *:*               LISTEN 277/stunnel
tcp        0      0 *:smtp           *:*               LISTEN 394/master
...
tcp        0      0 *:8577           *:*               LISTEN 57283/bash
...

# ps -fc 57283
UID PID PPID CLS PRI STIME TTY STAT TIME CMD
doug 57283 1 - 29 10:30 ? S 0:00 /home/tiger/bin/bash

So here we can see that /home/tiger/bin/bash (a copy of vncserver under a different name to avoid detection) is the process listening on port 8577, and it can be killed and tiger scolded as appropriate.

Alternatively, you can use lsof to do the same thing

# lsof -i tcp:8577
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
ssh 57283 tiger 3u IPv4 31740 TCP *8577 (LISTEN)

If you're interested in what the process is doing, you can use
lsof -p to see it's open files,
strace -p to watch it's system calls, or
ltrace -p to watch library calls.

If you're comfortable with full blown debugging, gdb can attach to it and give you all the control you could want.All of these actions require that you're root unless you own the process.

Thursday, July 1, 2010

DOS : IP and port Info using Netstat

Thursday, July 01, 2010

Anu

http://www.computercourage.com/wp-content/uploads/2008/07/250px-ms-dos_logo.jpg

Hello friends, thanks for reading this text on learning more about using netstat to help you. Please disregard any spelling or punction or any other grammer errors. This text is written so the average reader can understand it. Not to complicated. Please enjoy and feel free to email me.

Use of Netstat

- (To OPEN Netstat) - To open [Netstat] you must do the following: Click on the
- [Start] button - Then click [Programs] - Then look for [Ms-Dos Prompt].

Netstat is a very helpful tool that has many uses. I personally use Netstat to get IP addresses from other users I'm talking with on ICQ or AIM. Also you can use Netstat go moniter your port activity for attackers sending syn requests (part of the TCP/IP 3 way handshake) or just to see what ports are listening/Established. Look at the example below for the average layout of a responce to typing Netstat at the C:\windows\ prompt.

C:\WINDOWS#netstat

Active Connections

Proto Local Address Foreign Address State

TCP pavilion:25872 WARLOCK:1045 ESTABLISHED

TCP pavilion:25872 sy-as-09-112.free.net.au:3925 ESTABLISHED

TCP pavilion:31580 WARLOCK:1046 ESTABLISHED

TCP pavilion:2980 205.188.2.9:5190 ESTABLISHED

TCP pavilion:3039 24.66.10.101.on.wave.home.com:1031 ESTABLISHED

Now look above at the example. You will see [Proto] on the top left. This just tells you if the protocal is TCP/UDP etc. Next to the right you will see [Local Address] this just tells you the local IP/Hostname:Port open. Then to the right once again you will see [Foreign Address] this will give you the persons IP/Hostname and port in the format of IP:Port with ":" in between the port and IP.

And at last you will see [State] Which simply states the STATE of the connection.

This can be Established if it is connected or waiting connect if its listening.

Now with this knowledge we will dive into deeper on how to use this for monitering and port activity and detecting open ports in use.

Detecting Open ports

Now so you are noticeing something funny is going on with your computer? Your cd-rom tray is going crazy...Opening and closing when your doing nothing. And you say What the phruck is going on..or you realize someones been messing with a trojan on your computer.

So now your goal is to locate what trojan it is so you can remove it right? Well your right.

So you goto your ms-dos prompt. Now there are many ways to use Netstat and below is a help menu. Look through it.

C:\WINDOWS#netstat/?

Displays protocol statistics and current TCP/IP network connections.
NETSTAT [-a] [-e] [-n] [-s] [-p proto] [-r] [interval]
-a Displays all connections and listening ports.
-e Displays Ethernet statistics. This may be combined with the -s option.
-n Displays addresses and port numbers in numerical form.
-p proto Shows connections for the protocol specified by proto; proto may be TCP or UDP. If used with the -s option to display per-protocol statistics, proto may be TCP, UDP, or IP.
-r Displays the routing table.
-s Displays per-protocol statistics.
By default, statistics are shown for TCP, UDP and IP; the -p option may be used to specify a subset of the default. interval Redisplays selected statistics, pausing interval seconds between each display. Press CTRL+C to stop redisplaying statistics. If omitted, netstat will print the current configuration information once.

I personally like using (C:\Windows\Netstat -an) Which Displays all connections and listening ports in the form of IP instead of Hostname. As you see how i did the command Netstat(space)-a(Displays all connections and listening ports.)n(in numerical form)
Netstat -an -So doing that does TWO of the options at once no need for -a-n. So now that you know how to use netstat to view all your connections and listening you can search for common ports like 12345(old Netbus Trojan),1243(subseven) etc. This Becomes very handy for everything you will soon find out. Take a break now and go chill out on your couch and relax for about 5 minutes and let all this soak in then come back ready to learn more. :)

SYN and ACK

When you here Syn and Ack(ACKnowledge) you do not think of the communication of packets on your system. Well let me tell you what SYN and ACK do.

[SYN] - SYN in common words is a request for a connection used in the 3-way handshake in TCP/IP. Once you send a SYN out for a connection, the target computer will reply with a SYN and ACK. So basically when you see in [State] catagory Syn that means you are sending out a request to connect to something.

[ACK] - Now the ACK is a ACKnowledgement to the request made by a computer that is trying to connect to you. Once a Syn is sent to you you need to ACK it, then Send back another syn to the computer requesting connection to confirm the packet sent was correct.

I sure hope that helped you understand a little more about SYN and ACK. If you have further questions try looking for texts on TCP/IP (such as BSRF's TCP/IP text - blacksun.box.sk/tcpip.txt). Now onto the fun stuff.

Using Netstat it for ICQ and AIM

Have you ever wanted to get someones IP address or hostname using [Aol Instant Messanger] or [ICQ]? Well your in Luck.

[AIM] - With AIM you can not ussually find the exact IP address without some trial and error because most of the time it seems to open up all online users on Port 5190. So Less users online easier it is. So goto Ms-Dos Prompt and type netstat -n here you will see under [Foreign Addresses] a IP:With port 5190. Now one of those IP's connected to you with 5190 is going to be your target aim user. Just use trial and error to find out is ussually the easiest way.

[ICQ] - To get a IP using netstat of a ICQ user is easy before talking to the person on ICQ you must open ms-dos prompt and do netstat -n to list all IP's and ports.Write them down or copy them somewhere you will remember to look back. Now it's time to find out his IP. Message the user witha single message now quickly do Nestat -n. And you will have a new added line of a IP address, just search for the new one on the list under foreign and once you find it you now have your buddys ip without any patches or hacks. Pure skill :P.

Other Uses

Netstat can be used to get IPs of anything and anyone, as long as there's a direct connection between you and the target (i.e. direct messages, file transfers or ICQ chats in ICQ, DCC (Direct Client Connection) chat and file transfers in IRC etc' etc').

Tools and Utilities:

Port scanning: To look for any open ports on a computer:

- [7th Sphere Port scanner] - (2 mirror sites so if one link doesnt work)

- http://members.xoom.com/Cryptog/7spereportscan.exe

- http://members.xoom.com/gohan_3/7spereportscan.exe

Firewall to moniter Ports and registry:
- [Lockdown 2000]

- http://www.lockdown.com

For Communicating better:
- [ICQ]

- http://www.icq.com

- [Aol Instant Messanger]

- http://www.aol.com

Two Quick Tips

A - Sometimes Netstat can generate very long lists, which are especially confusing for newbies. If you're having difficulties, just run netstat, and then make a direct connection of some sort to your target, or make it connect to you (ICQ, IRC etc', you get the picture) and run netstat again. There should be a new line - this is what you're looking for.
B - If netstat's output is too long, type 'netstat -an greather than c:\some-directory\some-file.txt' (without the quotes, and you can replace the parameters -an and the filename and it's path with anything you'd like). This will dump the output to that file for easy viewing, and will also let you copy AND paste.

I think there are better ways to understand the internet than with tools you find.

Learn how to do stuff manually so you fully understand whats going on. This will fuel your power and kill your lameness :)

Sunday, May 30, 2010

DOS : Check to see if you are infected.

Sunday, May 30, 2010

Anu

When you first turn on you computer (BEFORE DIALING INTO YOUR ISP), open a MS-DOS Prompt window (start/programs MS-DOS Prompt).
Then type netstat -arn and press the Enter key.
Your screen should display the following (without the dotted lines which I added for clarification).

-----------------------------------------------------------------------------
Active Routes:

Network Address          Netmask     Gateway Address        Interface Metric
        127.0.0.0                255.0.0.0        127.0.0.1                127.0.0.1      1
255.255.255.255 255.255.255.255 255.255.255.255          0.0.0.0      1

Route Table

Active Connections

Proto Local Address          Foreign Address        State

--------------------------------------------------------------------------------

If you see anything else, there might be a problem (more on that later).
Now dial into your ISP, once you are connected; go back to the MS-DOS Prompt and run the same command as before netstat -arn, this time it will look similar to the following (without dotted lines).

-------------------------------------------------------------------------------------

Active Routes:

Network Address          Netmask     Gateway Address        Interface       Metric
          0.0.0.0                    0.0.0.0           216.1.104.70      216.1.104.70      1
        127.0.0.0                255.0.0.0         127.0.0.1            127.0.0.1            1
      216.1.104.0          255.255.255.0     216.1.104.70      216.1.104.70      1
    216.1.104.70        255.255.255.255    127.0.0.1           127.0.0.1            1
    216.1.104.255      255.255.255.255   216.1.104.70      216.1.104.70      1
        224.0.0.0               224.0.0.0          216.1.104.70      216.1.104.70      1
255.255.255.255    255.255.255.255   216.1.104.70      216.1.104.70      1

Route Table

Active Connections

Proto Local Address          Foreign Address        State
TCP    0.0.0.0:0                    0.0.0.0:0              LISTENING
TCP    216.1.104.70:137      0.0.0.0:0              LISTENING
TCP    216.1.104.70:138      0.0.0.0:0              LISTENING
TCP    216.1.104.70:139      0.0.0.0:0              LISTENING
UDP    216.1.104.70:137      *:*

--------------------------------------------------------------------------------

What you are seeing in the first section (Active Routes) under the heading of Network Address are some additional lines. The only ones that should be there are ones belonging to your ISP (more on that later). In the second section (Route Table) under Local Address you are seeing the IP address that your ISP assigned you (in this example 216.1.104.70).

The numbers are divided into four dot notations, the first three should be the same for both sets, while in this case the .70 is the unique number assigned for THIS session. Next time you dial in that number will more than likely be different.

To make sure that the first three notation are as they should be, we will run one more command from the MS-DOS window.
From the MS-DOS Prompt type tracert /www.yourispwebsite.com or .net or whatever it ends in. Following is an example of the output you should see.

---------------------------------------------------------------------------------------

Tracing route to /www.motion.net [207.239.117.112]over a maximum of 30 hops:
1 128 ms 2084 ms 102 ms chat-port.motion.net [216.1.104.4]
2 115 ms 188 ms 117 ms chat-core.motion.net [216.1.104.1]
3 108 ms 116 ms 119 ms www.motion.net [207.239.117.112]
Trace complete.

------------------------------------------------------------------------------------------

You will see that on lines with the 1 and 2 the first three notations of the address match with what we saw above, which is a good thing. If it does not, then some further investigation is needed.

If everything matches like above, you can almost breath easier. Another thing which should you should check is programs launched during startup. To find these, Click start/programs/startup, look at what shows up. You should be able to recognize everything there, if not, once again more investigation is needed.

-------------------------------------------------------------------------------------------

Now just because everything reported out like we expected (and demonstrated above) we still are not out of the woods. How is this so, you ask? Do you use Netmeeting? Do you get on IRC (Internet Relay Chat)? Or any other program that makes use of the Internet. Have you every recieved an email with an attachment that ended in .exe? The list goes on and on, basically anything that you run could have become infected with a trojan. What this means, is the program appears to do what you expect, but also does just a little more.
This little more could be blasting ebay.com or one of the other sites that CNNlive was talking about.

What can you do?

Well some anti-virus software will detect some trojans.
Another (tedious) thing is to start each of these "extra" Internet programs one at a time and go through the last two steps above, looking at the routes and connection the program uses. However, the tricky part will be figuring out where to tracert to in order to find out if the addresses you see in step 2 are "safe" or not. I should forewarn you, that running tracert after tracert, after tracert might be considered "improper" by your ISP. The steps outlined above may not work exactly as I have stated depending upon your ISP, but with a true ISP it should work. Finally, this advise comes with NO warranty and by following my "hints' you implicitly release me from ANY and ALL liability which you may incur.

Other options

Display protocol statistics and current TCP/IP network connections.
Netstat [-a] [-e] [-n] [-s] [-p proto] [-r] [intervals]

-a.. Display all connections and listening ports.
-e.. Display Ethernet statistics. This may be combined with the -s option.
-n.. Diplays address and port numbers in the numerical form.
-p proto..Shows connections for the protocol specified by proto; proto may be TCP or UDP. If used with the -s option to display per-protocol statistics, proto may be TCP, UDP, of IP.
-r.. Display the routing table.
-s.. Display per-protocol statistics. By default, statistics are shown for TCP
UDP and IP; the -p option may be used to specify a subset of the default interval..Redisplay selected statistics, pausing intervals seconds between each display. If omitted. netstat will print the current configuration information once.

Blog Archive

Popular Posts

Sunday, September 12, 2010

LINUX : How to find out that " Who listen on a specific port?"?

Thursday, July 1, 2010

DOS : IP and port Info using Netstat

Sunday, May 30, 2010

DOS : Check to see if you are infected.

Followers

Facebook

Networked Blogs