How can I tell who or what is connecting to my FreeNAS server?

[NASGuy]

About 2 years ago I set up a FreeNAS server for my local media. Today I noticed that there is quite a bit of disk activity that occurs in small bursts at roughly 30 second intervals, which coincides with network activity as indicated by the LEDs flashing on the switch that it's connected to. The problem is, I can't figure out what it's connecting to (or trying to connect to), or what is connecting to it. There should be nothing accessing it at that time of day. My local network is totally wired (no WiFi) and the connection to the Internet is via a router with a firewall that has NO ports open to the FreeNAS server.

My question is, for my own peace of mind is there any way I can tell what is going on, and whether someone or something is trying to connect to the server? And also, does FreeNAS try to connect to the outside world at regular intervals for some reason? Could it perhaps trying to connect to some server that no longer exists, maybe for software updates or something of that nature?

I never configured FreeNAS to do anything unusual, it was a pretty basic install and there is no additional software running on that box, and I pretty much set it up and forgot about it because it has been working so reliably up to this point. But it really bothers me that this is happening and I don't know why.

Thanks,
NASGuy

 

[erturne]

If you can ssh to your server as root (e.g. using PuTTY) you can use the netstat command to see the active network connections. It isn't much detail, but at least you could see which hosts are connected to your server. The netstat command has a ton of options, but here's where I would start:

Code:

[root@freenas] ~# netstat -n -f inet -p tcp
Active Internet connections
Proto Recv-Q Send-Q Local Address          Foreign Address        (state)
tcp4      0      0 127.0.0.1.9042        127.0.0.1.56593        TIME_WAIT
tcp4      0      0 192.168.1.2.443        192.168.1.7.40205      ESTABLISHED
tcp4      0      0 192.168.1.2.22        192.168.1.7.45229      ESTABLISHED
tcp4      0      0 192.168.1.2.445        192.168.1.7.34800      ESTABLISHED

In the example above I entered "netstat -n -f inet -p tcp" on the command line and it listed the IP addresses. You can ignore 127.0.0.1 because it's the server itself (called the localhost address). My server's address is 192.168.1.2 which you can see in the "Local Address" column. Under the "Foreign Address" column you can see my laptop, which has an address of 192.168.1.7.

I'm not sure this would show anything being accessed through a jailed plugin (e.g. tinyDLNA). A more comprehensive solution would be to run a packet sniffer on another computer on your network (e.g. your laptop). I run Linux on my laptop and have had good results capturing packets with the tcpdump command and analyzing them with Wireshark. I'm not sure what they have for Windows or Macintosh.

 

[fracai]

*old dupe; sorry*

 

[fracai]

tcpdump and wireshark are both available for Mac. I have mine installed through MacPorts, though they should also be available through Fink (Homebrew has Wireshark, but doesn't seem to have tcpdump; maybe a different package name?).

I'm sure Wireshark and some analog for tcpdump are available for Windows as well.

 

[NASGuy]

If you can ssh to your server as root (e.g. using PuTTY) you can use the netstat command to see the active network connections. It isn't much detail, but at least you could see which hosts are connected to your server. The netstat command has a ton of options, but here's where I would start:

Code:

[root@freenas] ~# netstat -n -f inet -p tcp
Active Internet connections
Proto Recv-Q Send-Q Local Address          Foreign Address        (state)
tcp4      0      0 127.0.0.1.9042        127.0.0.1.56593        TIME_WAIT
tcp4      0      0 192.168.1.2.443        192.168.1.7.40205      ESTABLISHED
tcp4      0      0 192.168.1.2.22        192.168.1.7.45229      ESTABLISHED
tcp4      0      0 192.168.1.2.445        192.168.1.7.34800      ESTABLISHED

In the example above I entered "netstat -n -f inet -p tcp" on the command line and it listed the IP addresses. You can ignore 127.0.0.1 because it's the server itself (called the localhost address). My server's address is 192.168.1.2 which you can see in the "Local Address" column. Under the "Foreign Address" column you can see my laptop, which has an address of 192.168.1.7.

I'm not sure this would show anything being accessed through a jailed plugin (e.g. tinyDLNA). A more comprehensive solution would be to run a packet sniffer on another computer on your network (e.g. your laptop). I run Linux on my laptop and have had good results capturing packets with the tcpdump command and analyzing them with Wireshark. I'm not sure what they have for Windows or Macintosh.

Thanks so much this is exactly what I was looking for.

NASGuy