topic Re: netstat - invalid addresses in Operating System - Linux

netstat - invalid addresses

M. Rozin — Fri, 07 Aug 2009 05:59:50 GMT

Hello people,

Does anybody know what exactly "invalid addresses" means in the output of netstat --statistics --raw?

Cheers,
Maxim.

Re: netstat - invalid addresses

Goran Koruga — Fri, 07 Aug 2009 06:32:13 GMT

Hello.

Just a short recommendation first - don't ask yes/no questions.

This is ipInAddrErrors from /proc/net/snmp - usually number of input diagrams that were discarded because they were not destined to the host in question.

Regards,
Goran

Re: netstat - invalid addresses

M. Rozin — Sat, 08 Aug 2009 07:56:37 GMT

Thank you very much Goran.

Why would these diagrams reach the host if they were not destined to it?

Cheers,
Maxim.

Re: netstat - invalid addresses

Matti_Kurkela — Sat, 08 Aug 2009 21:13:02 GMT

(Nitpick: I think Goran meant "datagrams", not "diagrams".)

There are many possible reasons.

Maybe a mis-configured host, switch or router somewhere near you in the network?

Maybe someone is intentionally sending unusual packets to see how your system reacts to them? This can be used to identify your OS and maybe probe for some vulnerabilities.

MK

Re: netstat - invalid addresses

Goran Koruga — Mon, 10 Aug 2009 05:26:48 GMT

Yes, good spot - I of course meant datagrams.

To find out why I think you'll need to look on other sytems, i.e. those that are sending them.

Goran

Re: netstat - invalid addresses

M. Rozin — Mon, 10 Aug 2009 06:24:02 GMT

well, that can be difficult, as I don't have access to all the internet users in the world.

Maxim.