UNIX for Dummies Questions & Answers

Dear Guys ,

I have linux - redhat 6.1 and it is on the internet , works as email server forworder .

when i execute netstat -a command i got a strange output that i want to ask about it and how can i control it or drop it plz :

the output looks like :

tcp 0 1 mydomain.com:2016 speakof.com:domain SYN_SENT
tcp 0 1 mydomain.com:2015 speakof.com:domain SYN_SENT
tcp 0 1 mydomain.com:2014 speakof.com:domain SYN_SENT
tcp 0 1 mydomain.com:2013 speakof.com:domain SYN_SENT
tcp 0 1 mydomain.com:2012 speakof.com:domain SYN_SENT
tcp 0 1 mydomain.com:2011 speakof.com:domain SYN_SENT
tcp 0 1 mydomain.com:2010 speakof.com:domain SYN_SENT
tcp 0 1 mydomain.com:2009 speakof.com:domain SYN_SENT
tcp 0 1 mydomain.com:2008 speakof.com:domain SYN_SENT
tcp 0 1 mydomain.com:2006 speakof.com:domain SYN_SENT

what is SYN_SENT !! and how can i drop many such hits ??

Thanks Alot

taking a shot here, am also new to TCP/IP so still learning...
TCP/IP is connection oriented, to establish a connection between 2 hosts, your PC sends a SYN (synchronize) bit to the other computer. Your PC then waits to receive an ACK bit, or acknowledgement bit from the opposite end. Finally, your PC sends another bit to tell the other computer which sequence number to begin with. When all of this hand shaking is complete, data begins to flow.

From O'Reilly, TCP Network Administration
"TCP views the data it sends as a continuous stream of bytes, not as independent packets. Therefore, TCP takes care to maintain the sequence in whihc bytes are sent and received. The Sequence Number and Acknowledgement Numbers in teh TCP segment header keep track of the bytes"

Your computer is attempting to open a TCP connection with another computer, looks like something related to the name server (perhaps a zone transfer from a zone that is not responding to your request?).

One way to resolve this is to use lsof to see which processes are attempting to open the connection. When you find out which processes on your end are attempting to open the connection, you can then determine the appropriate next step.

As TCP is connection oriented, SYN_SENT is a part of TCP three way handshake which TCP does before Establishing a connection.

Regards,
Yeheya

Thanks Guys ,

Yes i agree with you that is it is TCP packet , and my server try to talk with other domains .

but why this huge no. of connections ot hits .. i have more than 500 line from that output .

Also while i was chekcing i discovered some files in /tmp directory with the follwoing contents , would you plz tell me what does it do !! :

find=/usr/lib/.../find
du=/usr/lib/.../du
ls=/usr/lib/.../ls
file_filters=uconf.inv,.config,bkit-,...,.tmp,bk5

[ps]
ps=/usr/lib/.../psr
lsof=/usr/lib/.../lsof
ps_filters=...,psr,bkit-,dufiles,downund3r,xfool,thewebri,bk5
lsof_filters=...,uconf.inv,psr,:6666,:5559,:irc,:5454,:4545,bkit-,:45091,:53
419,
bk5

[netstat]
netstat=/usr/lib/.../netstat
net_filters=6666,5559,irc,5454,4545,45091,53419,dufiles,downund3r,xfool,thew
ebri


thanks again

Please download and install lsof. With this program you will be able to understand and manage your network connections much better.

Search the forums for previous posts on using lsof.