Odd internal connections

Question

I recently noticed quite a few odd internal connections from our Apache server 79.134.108.134.

The server does not have public tcp6 address.

Why is the Apache server connecting from port 80 to random high number local/internal ports with tcp6?

tcp6 0 0 79.134.108.134:80 79.134.108.134:42189 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42094 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42131 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42202 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42127 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42096 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42225 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42192 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42213 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42110 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42111 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42150 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42061 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 62.78.173.45:52132 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42132 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42179 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 78.27.124.85:50972 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42079 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 78.27.124.85:53132 FIN_WAIT2 -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42196 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42072 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42209 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42193 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42187 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42221 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42190 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42118 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42066 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 46.229.168.73:50922 TIME_WAIT -
tcp6 0 0 79.134.108.134:80 79.134.108.134:42210 TIME_WAIT -

What does `netstat -np` say? Does it points to the process doing this? What is the server running, Tomcat, wordpress, Java.... what does `ps uax` say? — Rui F Ribeiro, Feb 28 '18 at 16:43

Rui F Ribeiro · Answer 1 · 2018-03-17T09:34:22.353

Nowadays Linux uses tcp6 pretty much by default; the kernel starts with both IPv6 and IPv4 stacks, and unless you take steps/configure a service to bind only to IPv4, usually the port is reserved both for IPv6 or IPv4.

So, you not having an IPv6 public address configured is not of consequence of not seeing there tcp6. In this context, both IPv4 and IPv6 connections will be characterised as tcp6 when using netstat.

As for the list of connections, you will see they all use IPv4 addresses, so they cannot be IPv6 connections.

Furthermore, having a connection from a random non-privileged high address (known as ephemeral ports) to a service port (in this case 80/TCP - HTTP), is pretty much how the TCP protocol works, and how clients use your site, so actually this is not strange also.

I would be more worried about the number of connections from the IP address 79.134.108.134 though. However, without knowing your site, service, and implementation, I cannot say definitively whether this is supposed to be normal, a process run amok, an aplicacional implementation or some configuration error.

It may also might be worthy having a look at your Apache access.log logfiles to see what and if any pages/services are being accessed. This might give you a clue about the nature of the connections.

I advise nonetheless, for the future, that is worthy investigating how to rate-limit clients in Apache, and opening question(s) about doubts on the subject.

see related Using a load balancer instead of Apache to throttle transactions from specific IP's

How block all request as ServerIP:Port by iptables

How to use Fail2Ban to protect ProxyPass(ed) applications

While off-topic, I also advise the best reference for learning TCP/IP https://www.amazon.com/TCP-Illustrated-Protocols-Addison-Wesley-Professional/dp/0321336313

PS I would think about hiring the services of an experienced consultant/sysadmin.

Odd internal connections

1 Answers1