2

Novell Linux server used for Novell Access Gateway. When I run netstat -a I get thousands of CLOSE_WAIT state connections from localhost:xxxx to localhost:snpp.

1st question how can I trace the connection to its source. Source being the executable causing it.

2nd question is that normal for this kind of server? I'm reading about SNPP online and all I see is it's a pager related protocol. I'm not doing anything pager related on this server.

Thanks

Tigran
  • 155
  • 4

1 Answers1

0

You almost had it with netstat, try netstat -ape

  • -a for all listening & non-listening sockets
  • -p to show the PID (and name) of the application that created the sockets
  • -e show extra information (can't hurt)

SNPP could be a false alarm, with out -n netstat will automatically lookup the port number (SNPP is port 444) and return the name, as defined in /etc/services

kband
  • 459
  • 2
  • 6