On Fri, 2008-03-28 at 10:27 +0530, kk CHN wrote: > $ sockstat -4p 80 > USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS > www httpd 73932 3 tcp4 127.0.0.1:80 *:* > www python2.4 44496 20 tcp4 my_Serverbox_public_IPAddress > :65287 164.115.5.2:80 This is some python program requesting http content FROM 164.115.5.2:80. Could be a dynamic include in your website, or could be something very wrong. 164.115.5.2 advertises itself as linux.thai.net if that makes any sense to you.. Regards Henrik
