netstat and what is connected to my server

I am trying to get an idea of what is connecting to my machine internally and externally.
Using netstat -t I can see some of the ip address of the machine, internal as well as external ip address of machines connected to my machine.  is there away to get more information of harmful attempts vs normal attempts?

here is some netstat output
tcp        0      0 mail.domain:smtp aky179.neoplus.adsl.t:rnmap TIME_WAIT  
tcp        0      0 mail.domain:ndmp 192.168.1.22:timestenbroker ESTABLISHED
tcp        0      0 mail.domain:ndmp 192.168.1.227:nattyserver   ESTABLISHED
tcp        0      0 mail.domain:smtp 59.92.39.244:netbill-auth   ESTABLISHED
...
tcp        0      0 mail.domain:pop3 ::ffff:192.168.1.6:bvtsonar TIME_WAIT  
tcp        0      0 mail.domain:pop3 ::ffff:192.1:teleniumdaemon TIME_WAIT  
tcp        0      0 mail.domain:pop3 ::ffff:192.168.1.:hpvmmdata TIME_WAIT  
tcp        0      0 mail.domain:pop3 ::ffff:192.1:krb5gatekeeper TIME_WAIT  
iceman19330Asked:
Who is Participating?
 
_iskywalker_Connect With a Mentor Commented:
netstat -ntlp as root says a lot.
you should start there, then go to lsof (shows which files are opens, sockets are files, so you see also opened sockets).
if you want to trace you nettraffic try ethereal. it traces the traffic so you see what is send and what is received.
0
 
xDamoxCommented:
Hi,

Have you tried using:

netstat -ntlp

This should show all the connections
0
 
ygouthamCommented:
harmful events are more often recorded in

/var/log/secure
/var/log/messages

do a

tail -f /var/log/messages

netstat -an

might give a list of ip addresses and you might want to do a

cat /var/log/messages | grep ip.address.from.netstat.here

which might show only relevant messages...
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.