Dodgy looking info on netstat

General Network security, firewalls, port filtering/forwarding, wireless security, anti-spyware, as well as spam control and privacy discussions.
Post Reply
HowardTheDuck
New Member
Posts: 1
Joined: Thu Jan 26, 2012 11:02 am

Dodgy looking info on netstat

Post by HowardTheDuck »

Hi all, I've been having some connection issues lately and so just decided to do a netstat to have a look what's going on, and I saw this:
TCP 192.168.0.2:51440 lhr08s01-in-f8:http TIME_WAIT
TCP 192.168.0.2:51442 we-in-f139:http TIME_WAIT
Looks very dodgy with that timer, especially the "we-in" address that has me nervous.

Is there anyone that could shed some light on this?
Top
nwrickert
Member
Posts: 44
Joined: Wed Apr 18, 2012 6:46 pm
Location: Chicago suburbs

Post by nwrickert »

This forum must be slow. More than 6 months, and no response.

In any case, that "netstat" output is quite normal. You recently had http connections to the two sites. The connections were closed. It is standard procedure to put the connection into TIME_WAIT state for a while (typically 1-3 minutes, depending on the operating system).

The intended purpose is that there might be some stray packets for the connection that were delayed. Because the system is temporarily retaining information about this connection, it can recognize those stray packets as related, and drop them (i.e. silently ignore them).
Top
User avatar
Shinobi
Senior Member
Posts: 4455
Joined: Sat Jan 06, 2001 12:00 am
Location: South Carolina

Post by Shinobi »

nwrickert wrote:This forum must be slow. More than 6 months, and no response.
Welcome to Speedguide :)


I'm glad there are new members like yourself to pick up the slack. Glad your here. :nod:
_______________________________________________
Vendor neutral certified in IT Project Management, IT Security, Cisco Networking, Cisco Security, Wide Area Networks, IPv6, IT Hardware, Unix, Linux, and Windows server administration
[SIGPIC][/SIGPIC] :thumb:
Top
Becu Mara
New Member
Posts: 2
Joined: Thu Aug 04, 2016 3:01 am

Post by Becu Mara »

« SpeedGuide.net TCP Analyzer Results »
Tested on: 2016.08.04 02:55
IP address: 141.134.xxx.xx
Client OS/browser: Android (Chrome 51.0.2704.81)

TCP options string: 0204058c0402080a00532a120000000001030307
MSS: 1420
MTU: 1460
TCP Window: 87680 (NOT multiple of MSS)
RWIN Scaling: 7 bits (2^7=128)
Unscaled RWIN : 685
Recommended RWINs: 65320, 130640, 261280, 522560, 1045120
BDP limit (200ms): 3507kbps (438KBytes/s)
BDP limit (500ms): 1403kbps (175KBytes/s)
MTU Discovery: ON
TTL: 50
Timestamps: ON
SACKs: ON
IP ToS: 00000000 (0)


I don't know what the do
Top
Becu Mara
New Member
Posts: 2
Joined: Thu Aug 04, 2016 3:01 am

Post by Becu Mara »

« SpeedGuide.net TCP Analyzer Results »
Tested on: 2016.08.04 02:55
IP address: 141.134.xxx.xx
Client OS/browser: Android (Chrome 51.0.2704.81)

TCP options string: 0204058c0402080a00532a120000000001030307
MSS: 1420
MTU: 1460
TCP Window: 87680 (NOT multiple of MSS)
RWIN Scaling: 7 bits (2^7=128)
Unscaled RWIN : 685
Recommended RWINs: 65320, 130640, 261280, 522560, 1045120
BDP limit (200ms): 3507kbps (438KBytes/s)
BDP limit (500ms): 1403kbps (175KBytes/s)
MTU Discovery: ON
TTL: 50
Timestamps: ON
SACKs: ON
IP ToS: 00000000 (0)
Top
Post Reply

Return to “Network Security”