当我通过 ssh 进入我的服务器时,我会定期检查netstat --tcp
,但是今天发现了一种我以前从未见过的奇怪的带连字符的地址格式:
Proto Recv Sent Local Address Foreign Address State
tcp6 0 0 mydomain.com:www xxx-xxx-xxx-xxx.bng:xxxx TIME_WAIT
它就像一个 IP 地址,x 代表数字,但由于带有连字符,我认为它可能是一个域名,但“.BNG”不是顶级域名。
我在谷歌上搜索到的所有信息都是思科的“宽带网络网关”,所以这可能与我的主机有关?
答案1
您看到的名称是反向 DNS 域中的内容,它不必是有效的。网络管理员可以在反向 DNS 中输入任何他/她想要的内容。如果您想知道谁正在连接到您的服务器,您应该使用 查看 IP 地址netstat --tcp --numeric
。
如果您想知道哪个组织是 IP 地址的持有者,您可以使用whois
,它将向您显示谁是持有者。数据分布在不同的 whois 服务器上,但最近的 whois 客户端可能会自动确定正确的服务器(我删除了一些输出以使其更易读/易懂):
$ whois 37.77.56.75
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
NetRange: 37.0.0.0 - 37.255.255.255
CIDR: 37.0.0.0/8
OriginAS:
NetName: RIPE-37
NetHandle: NET-37-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
RegDate: 2010-11-30
Updated: 2011-01-17
Ref: http://whois.arin.net/rest/net/NET-37-0-0-0-1
ReferralServer: whois://whois.ripe.net:43
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf
% Information related to '37.77.56.64 - 37.77.56.95'
% Abuse contact for '37.77.56.64 - 37.77.56.95' is '[email protected]'
inetnum: 37.77.56.64 - 37.77.56.95
netname: STEFFANN-OFFICE1
descr: S.J.M. Steffann Office
country: NL
admin-c: SJMS-RIPE
tech-c: SJMS-RIPE
status: ASSIGNED PA
mnt-by: STEFFANN-MNT
mnt-by: STEFFANN-AUTO-MNT
source: RIPE # Filtered
role: SJM Steffann NOC contact
address: Tienwoningenweg 46
address: 7312 DN Apeldoorn
address: The Netherlands
admin-c: SJMS1-RIPE
tech-c: SJMS1-RIPE
abuse-mailbox: [email protected]
nic-hdl: SJMS-RIPE
mnt-by: STEFFANN-MNT
source: RIPE # Filtered
% Information related to '37.77.56.0/21AS57771'
route: 37.77.56.0/21
descr: S.J.M. Steffann
origin: AS57771
mnt-by: STEFFANN-MNT
source: RIPE # Filtered
% This query was served by the RIPE Database Query Service version 1.60.2 (WHOIS3)
因此,在这里您可以看到 37.77.56.75 属于网络 STEFFANN-OFFICE1,这是我的办公室。您还可以看到您应该联系[电子邮件保护]当您看到来自该网络的滥用行为时。