ipv6 connections to localhost 443

Abdussamad

I am seeing strange ipv6 connections originating from localhost and connecting to localhost https:

tcp6 0 0 ::1:47711 ::1:443 TIME_WAIT - tcp6 0 0 ::1:47710 ::1:443 TIME_WAIT -

I've tried netstat, fuser and lsof to identify the process behind these but with no luck. Searching shows that others have noticed these too on their systems but with no explanation as to the source. Do you guys know what might be causing these connections?

jamesr

sudo netstat -pane | grep :443
(make sure you're running it as root basically, either via sudo or whatever...)

Abdussamad

@jamesr said:
sudo netstat -pane | grep :443
(make sure you're running it as root basically, either via sudo or whatever...)

As mentioned in the OP I already tried using netstat with the -p switch. also fuser and lsof.

The output you see in the OP is netstat -antlp greped. You can see that it is showing a dash in the rightmost program column.

ska

Do you have a FastCGI-socket enabled?

Abdussamad

@ska said:
Do you have a FastCGI-socket enabled?

PHP is running as mod_php so I don't think so.

jamesr

Not that easy to tell what command you used since its not in the OP.

Good luck.

ska

Well, you need to check where you/your system initates socket calls.

Eg. if you're running a VPN on 443 and have some IPTables routings (maybe additionally with dnsmasq) that TIME_WAIT indicates that the socket is waiting after close to handle packets still in the network.

Abdussamad

@ska said:
Well, you need to check where you/your system initates socket calls.

How do I do that?

ska

@Abdussamad said:
How do I do that?

Monitor the ESTABLISHED connections, keep track of them and cross-check with TIME_WAIT connections.