27

This is what I see in Nethogs:

Screenshot

I'm concerned about the listings with PID ?, running as root. How can I find out what these are? I'm running Linux Mint 14.

Please let me know what other information I should include.

Alex D
  • 721
  • 6
  • 10
  • Are you running nethogs as root? `netstat -tap` can also show programs related to the connections (if it runs as root). The IPs seems to be some japan yahoo pages. – jofel Sep 17 '13 at 13:49

1 Answers1

21

Those are TCP connections that were used to make an outgoing connection to a website. You can tell from the trailing :80 which is the port that's used for HTTP connections to web servers, typically. After the 3 way TCP connection handshake has completed the connections are left in a "wait to close" state.

This bit is your local system's IP address and that's the port that was used to make the connection to the remote web server:

IP: 192.168.0.100  PORT: 50161

Example

Here's output from my system using netstat -ant:

tcp        0      0 192.168.1.20:54125          198.252.206.25:80           TIME_WAIT

Notice the state at the end? It's TIME_WAIT. You can further convince yourself of this by adding the -p switch so we can see what process is bound/associated to this particular connection:

$ sudo netstat -antp | grep 192.168.1.20:54125
$

This shows that no process was affiliated with this.

slm
  • 363,520
  • 117
  • 767
  • 871
  • 1
    So for non-networking-savvy users, in short... these are not separate processes at all but are connections which were made by my web browser, and which are waiting to close? (In `netstat` I can see their state is `LAST_ACK`.) – Alex D Sep 17 '13 at 15:05
  • @AlexD - yes they're waiting to be closed. – slm Sep 17 '13 at 15:10
  • 2
    Thx vm! I suspected they were from firefox, but the root user made me nervous... Using `netstat -ant` showed all 15 connections (most (or all?) were to google gru- servers) of :443 ssh, and they were the ESTABILISHED kind. Then I force closed firefox with 12 open tabs (to easily restore session), and ran that cmd again, and all connections went to TIME_WAIT, and most just vanished! – Aquarius Power Jan 23 '21 at 17:57
  • I am seeing these on my ubuntu server where no browser instance is running. Only nginx is running. Can these connections be opened by client browsers? – sureshvv Sep 04 '21 at 14:10