Question Locked

Telnet and netstat

0 helpful
4 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
If i use netstat, and see that there is a address beforehand with a :telnet afterwards, am i being audited? :) thanks !

4 replies

by seanferd

edit: I am putting tis edit at the top, in case it is your answer. The ':telnet' may mean that the is an active open telnet port on your system. It is listening. Otherwise, you should get further info regarding an actual connection (what other IP address is trying to make a connection to you, or if is already established.
end edit.

DOS/Windows command?
GNU/Linux utility?
The AnalogX Windows utility?
It may make a difference.
Are you on a network, just connected to the Internet?

I don't use these things a lot, but I may have a few hints. Telnet is a protocol used to send commands to a system across a network, but protocols like HTTP are much more frequently used these days. This may be indicating that someone is trying to telnet into your machine, or maybe it is just indicating that a port is available for telnet (usually TCP port 23, but not necessarily).

You aren't on a mainframe, are you? Even on a LAN, SysAdmins may use this for debugging and stuff. I suppose it is possible that someone is trying to have a peek at you. Or crack your system.

Anyway, can you post a little more of your particulars (OS, what kind of network, which netstat you are using) and maybe a little of the output from netstat (hide actual IP addresses) and what parameters you are calling netstat with, if any.

I am going to quit while I still know (maybe) what I am talking about. There are quite a few people here that could probably give you an answer in two seconds flat, given a little more info.

by rt735

I Used no parameters, its a DOS/Windows Netstar, im on a LAN of a huge corp. domain enviroment, this connection could be for the applications that they drop to my machine as we do use a sms portal for aplications but i had no direct connection with the portal at the time of the command.

by seanferd

If Telnet is listing only under Local Address, it just means that your local system is listening on a port for any telnet connections. If there is an address listed under Foreign Address that is not localhost, it is an actual incoming connection. Check under connection state to see if it actually becomes Established. If there are repeated failed attempts from an unknown foreign address, with no connection being established, then talk to your Admin. Could be someone is doing a little hacking. Otherwise, your Admin or some automation is checking the network or dropping some commands on your box.

This discussion is closed to new replies.