0

I'm trying to search the IP addresses that my PC is connected to, but I don't recognize these & search shows nothing.

I'm looking into all my connections, so I ran netstat -a and I don't recognize the format of these foreign address results. Can someone help put them into a format that I can type into an address bar or search on whatismyipaddress.com or explain how I can look them up?

roto Local Address Foreign Address State
CP 192.168.XXX.XXX:XXX a72-246-162-195:http TIME_WAIT
CP 192.168.XXX.XXX:XXX server-18-65-3-90:https ESTABLISHED
CP 192.168.XXX.XXX:XXX ec2-35-165-182-128:https ESTABLISHED
CP 192.168.XXX.XXX:XXX 102:https ESTABLISHED
CP [2603:8000:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx]:xxxxx g2600-1406-4c00-0000-0000-0000-170c-282a:https CLOSE_WAIT
CP [2603:8000:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx]:xxxxx lax17s55-in-x03:https ESTABLISHED
CP [2603:8000:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx]:xxxxx lax31s19-in-x0e:https ESTABLISHED
3
  • 2
    Define "standard format" please. Commented May 29, 2022 at 22:08
  • en.wikipedia.org/wiki/IPv6
    – Gantendo
    Commented May 29, 2022 at 23:17
  • Get advanced IP scanner (Famatech) and see if you can identify local IP addresses. Also get a packet sniffer (Wire Shark is free - I use Comm View) and identify the relationship between local IP and external IP.
    – anon
    Commented May 29, 2022 at 23:28

3 Answers 3

0

By default netstat tries to show you the "reverse DNS" lookup results of each address... but truncates all but the leftmost component for some reason.

Use the -n option to get raw IP addresses instead.

1

As user1686 mentioned, you can use -n to get the IP addresses.

Alternatively, use netstat -f to get the complete domain names (FQDN).

0

You don't say which platform, but for Linux (i.e. Ubuntu) from this answer to How to easily get all HTTPS addresses that an application connects to externally?:

You can use lsof and watch to do this, like so:

$ watch -n1 lsof -i TCP:80,443 

Example output

dropbox    3280 saml   23u  IPv4 56015285      0t0  TCP greeneggs.qmetricstech.local:56003->snt-re3-6c.sjc.dropbox.com:http (ESTABLISHED) 
thunderbi  3306 saml   60u  IPv4 56093767      0t0  TCP greeneggs.qmetricstech.local:34788->ord08s09-in-f20.1e100.net:https (ESTABLISHED) 
mono       3322 saml   15u  IPv4 56012349      0t0  TCP greeneggs.qmetricstech.local:54018->204-62-14-135.static.6sync.net:https (ESTABLISHED) 
chrome    11068 saml  175u  IPv4 56021419      0t0  TCP greeneggs.qmetricstech.local:42182->stackoverflow.com:http (ESTABLISHED) 

or just

$ lsof -i TCP:80,443 -r 2

but the output isn't as pretty, nor are the addresses as readable, although the past connections are better preserved:

=======
COMMAND  PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
firefox 9542 user   27u  IPv4 1068219      0t0  TCP user-300V3Z-300V4Z-300V5Z:37360->192.0.78.23:https (ESTABLISHED)
firefox 9542 user   48u  IPv4 1053405      0t0  TCP user-300V3Z-300V4Z-300V5Z:45948->ec2-54-213-37-69.us-west-2.compute.amazonaws.com:https (ESTABLISHED)
=======
COMMAND  PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
firefox 9542 user   27u  IPv4 1068219      0t0  TCP user-300V3Z-300V4Z-300V5Z:37360->192.0.78.23:https (ESTABLISHED)
firefox 9542 user   48u  IPv4 1053405      0t0  TCP user-300V3Z-300V4Z-300V5Z:45948->ec2-54-213-37-69.us-west-2.compute.amazonaws.com:https (ESTABLISHED)
firefox 9542 user   52u  IPv4 1138942      0t0  TCP user-300V3Z-300V4Z-300V5Z:57602->kul08s01-in-f10.1e100.net:https (SYN_SENT)
firefox 9542 user  102u  IPv4 1139934      0t0  TCP user-300V3Z-300V4Z-300V5Z:49102->kul09s13-in-f14.1e100.net:https (ESTABLISHED)
firefox 9542 user  110u  IPv4 1138950      0t0  TCP user-300V3Z-300V4Z-300V5Z:49104->kul09s13-in-f14.1e100.net:https (SYN_SENT)
=======
...
=======
COMMAND  PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
firefox 9542 user   27u  IPv4 1068219      0t0  TCP user-300V3Z-300V4Z-300V5Z:37360->192.0.78.23:https (ESTABLISHED)
firefox 9542 user   48u  IPv4 1053405      0t0  TCP user-300V3Z-300V4Z-300V5Z:45948->ec2-54-213-37-69.us-west-2.compute.amazonaws.com:https (ESTABLISHED)
firefox 9542 user   51u  IPv4 1140129      0t0  TCP user-300V3Z-300V4Z-300V5Z:52284->kul09s13-in-f10.1e100.net:https (ESTABLISHED)
firefox 9542 user  108u  IPv4 1137384      0t0  TCP user-300V3Z-300V4Z-300V5Z:55886->103.229.10.236:https (ESTABLISHED)
firefox 9542 user  122u  IPv4 1137399      0t0  TCP user-300V3Z-300V4Z-300V5Z:55870->kul08s12-in-f1.1e100.net:https (ESTABLISHED)
firefox 9542 user  126u  IPv4 1137402      0t0  TCP user-300V3Z-300V4Z-300V5Z:47370->stackoverflow.com:https (SYN_SENT)

Note: Every two seconds interval is separated by =======.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .