Re: [cobalt-users] Help! The case of the disapearing remote Raq3...

["Robin Vley" <rvley@xxxxxxxxx>]

On Wed, 13 Feb 2002 12:39:17 -0500, Cobalter wrote:

>Recently, our Raq3 has developed a habit of "disappearing" from the net (no 
>services, no pinging, no nuttin'!) for about 45 minutes at a time (It's 
>hundreds of miles away in a colo place, so for all I know it's out getting 
>coffee).

I hope my servers won't get that coffee thing! :)

>(By the way, I just happened to do a 'netstat -la' just before sending this 
>off. While MOST things looked normal, I'm puzzled by all the localhost 
>ricocheting on so many ports that seems to be going on at the top...) 
>Another netstat right after this showed plain ol' normal activity, 
>though... Any connection/thoughts?

Others on the list will probably be able to give you a better answer
that I can, but when browsing to your netstat output, I had a couple of
Uhhh?'s, and I will share them with you, who knows it's usefull. 
If you mean the local host connects that were shown at the top, these
are MySQL connections that appear when a mysql powered web is visited
or used. Nothing to worry about I think.
The others are probably the monitor, monitoring, though there are some
"funny" ports in that list like:

>localhost:617		localhost:2755	CLOSE_WAIT	
>localhost:2755		localhost:617	FIN_WAIT2	

And then we get this:

>tcp	0	0	*:7937	*:*	LISTEN	
>tcp	0	0	*:7938	*:*	LISTEN	

What are those?

>tcp	0	0	*:snpp	*:*	LISTEN	

You don't have this open in the air, right? It's closed in the firewall
that you are running ofcourse. :)

>tcp	0	0	*:617	*:*	LISTEN	

What's that?

>tcp	0	0	*:imap2	*:*	LISTEN	

If you're not using that, disable it or dont open the port in firewall.

>tcp	0	0	*:mysql	*:*	LISTEN	

Make sure this is not running to the outside either, I guess. :)


Those are the only things that raising question marks here.



I would look into those, thought they might have nothing to do with
your coffee problem.


---
RW. Vley
Stockholm, Sweden