netstat shows many times deploy.akamaitechnologies.com connected to my server

Question

Many times, after running netstat on my server, I find one of IP addresses belonging to deploy.akamaitechnologies.com connected to my server, do someone has an idea on what is happening on my server ?

this is a case:

TCP xxx.xxx.xxx.xxx:49189 a184-25-107-184:http ESTABLISHED

To what could serve the port: 49189 when the source machine is running http ?

Solution

Your server is connecting to HTTP on the deploy.akamaitechnologies.com server, not the other way around. Run netstat -a -n -o on your server and see what PID (process ID) is responsible for the connection and investigate from there.

Comments

[Sami-L]

I am on IIS 7, how can I see what this IP is doing, and how can I block it please?

[alexus]

look in your IIS log what this IP is doing on your box so extensively to block it you can use IIS as well (or firewall)

[Sami-L]

Is there an iis log viewer / analyzer inside Windows 2008 R2, or have I to dowload it somewhere ? I can block the used IP address through the firewall but each time they use a different one, I mean: deploy.akamaitechnologies.com

[David Schwartz]

Why would he look in his Apache log? It's the local port that's dynamic.

[Sami-L]

@David, So you think that something installed on my server connects to them from time to time?

[David Schwartz]

Yes. If you have the ability to log the HTTP headers, that would probably narrow it down.