# Weird TCP connection to host6.diocesedesobral100anos.com **URL:** \ **Category:** Elasticsearch\ **Created:** [November 24, 2017, 10:03pm UTC](https://discuss.elastic.co/t/weird-tcp-connection-to-host6-diocesedesobral100anos-com/109088 "2017-11-24T22:03:01Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![abbasovalex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abbasovalex/32/24667_2.png) [@abbasovalex](https://discuss.elastic.co/u/abbasovalex)\ **Post date:** [November 24, 2017, 10:03pm UTC](https://discuss.elastic.co/t/weird-tcp-connection-to-host6-diocesedesobral100anos-com/109088/1 "2017-11-24T22:03:01Z")
Hello! I need help. When I run > lsof -a -p \ then I am seeing next lines: java 22834 elasticsearch 158u IPv6 285317013 0t0 TCP cs24290:vrace-\>[host6.diocesedesobral100anos.com:40709](http://host6.diocesedesobral100anos.com:40709) (ESTABLISHED) java 22834 elasticsearch 159u IPv6 285317014 0t0 TCP cs24290:vrace-\>[host6.diocesedesobral100anos.com:40711](http://host6.diocesedesobral100anos.com:40711) (ESTABLISHED) java 22834 elasticsearch 160u IPv6 285317015 0t0 TCP cs24290:vrace-\>[host6.diocesedesobral100anos.com:40712](http://host6.diocesedesobral100anos.com:40712) (ESTABLISHED) java 22834 elasticsearch 161u IPv6 285317016 0t0 TCP cs24290:vrace-\>[host6.diocesedesobral100anos.com:40714](http://host6.diocesedesobral100anos.com:40714) (ESTABLISHED) java 22834 elasticsearch 162u IPv6 285317017 0t0 TCP cs24290:vrace-\>[host6.diocesedesobral100anos.com:40716](http://host6.diocesedesobral100anos.com:40716) (ESTABLISHED) java 22834 elasticsearch 163u IPv6 285317018 0t0 TCP cs24290:vrace-\>[host6.diocesedesobral100anos.com:40710](http://host6.diocesedesobral100anos.com:40710) (ESTABLISHED) java 22834 elasticsearch 164u IPv6 285317019 0t0 TCP cs24290:vrace-\>[host6.diocesedesobral100anos.com:40718](http://host6.diocesedesobral100anos.com:40718) (ESTABLISHED) java 22834 elasticsearch 165u IPv6 285317020 0t0 TCP cs24290:vrace-\>[host6.diocesedesobral100anos.com:40713](http://host6.diocesedesobral100anos.com:40713) (ESTABLISHED) java 22834 elasticsearch 166u IPv6 285317021 0t0 TCP cs24290:vrace-\>[host6.diocesedesobral100anos.com:40715](http://host6.diocesedesobral100anos.com:40715) (ESTABLISHED) java 22834 elasticsearch 167u IPv6 285317022 0t0 TCP cs24290:vrace-\>[host6.diocesedesobral100anos.com:40717](http://host6.diocesedesobral100anos.com:40717) (ESTABLISHED) java 22834 elasticsearch 168u IPv6 285317023 0t0 TCP cs24290:vrace-\>[host6.diocesedesobral100anos.com:40720](http://host6.diocesedesobral100anos.com:40720) (ESTABLISHED) java 22834 elasticsearch 169u IPv6 285317025 0t0 TCP cs24290:vrace-\>[host6.diocesedesobral100anos.com:40719](http://host6.diocesedesobral100anos.com:40719) (ESTABLISHED) java 22834 elasticsearch 170u IPv6 285317026 0t0 TCP cs24290:vrace-\>[host6.diocesedesobral100anos.com:40721](http://host6.diocesedesobral100anos.com:40721) (ESTABLISHED) java 22834 elasticsearch 171u IPv6 285311847 0t0 TCP cs24290:42468-\>[host6.diocesedesobral100anos.com](http://host6.diocesedesobral100anos.com):vrace (ESTABLISHED) java 22834 elasticsearch 172u IPv6 285311848 0t0 TCP cs24290:42469-\>[host6.diocesedesobral100anos.com](http://host6.diocesedesobral100anos.com):vrace (ESTABLISHED) java 22834 elasticsearch 173u IPv6 285311850 0t0 TCP cs24290:42470-\>[host6.diocesedesobral100anos.com](http://host6.diocesedesobral100anos.com):vrace (ESTABLISHED) java 22834 elasticsearch 174u IPv6 285311851 0t0 TCP cs24290:42471-\>[host6.diocesedesobral100anos.com](http://host6.diocesedesobral100anos.com):vrace (ESTABLISHED) java 22834 elasticsearch 175u IPv6 285311852 0t0 TCP cs24290:42472-\>[host6.diocesedesobral100anos.com](http://host6.diocesedesobral100anos.com):vrace (ESTABLISHED) java 22834 elasticsearch 176u IPv6 285311853 0t0 TCP cs24290:42473-\>[host6.diocesedesobral100anos.com](http://host6.diocesedesobral100anos.com):vrace (ESTABLISHED) java 22834 elasticsearch 177u IPv6 285311854 0t0 TCP cs24290:42474-\>[host6.diocesedesobral100anos.com](http://host6.diocesedesobral100anos.com):vrace (ESTABLISHED) java 22834 elasticsearch 178u IPv6 285311855 0t0 TCP cs24290:42475-\>[host6.diocesedesobral100anos.com](http://host6.diocesedesobral100anos.com):vrace (ESTABLISHED) java 22834 elasticsearch 179u IPv6 285311856 0t0 TCP cs24290:42476-\>[host6.diocesedesobral100anos.com](http://host6.diocesedesobral100anos.com):vrace (ESTABLISHED) java 22834 elasticsearch 180u IPv6 285311857 0t0 TCP cs24290:42477-\>[host6.diocesedesobral100anos.com](http://host6.diocesedesobral100anos.com):vrace (ESTABLISHED) java 22834 elasticsearch 181u IPv6 285311858 0t0 TCP cs24290:42478-\>[host6.diocesedesobral100anos.com](http://host6.diocesedesobral100anos.com):vrace (ESTABLISHED) java 22834 elasticsearch 182u IPv6 285311859 0t0 TCP cs24290:42479-\>[host6.diocesedesobral100anos.com](http://host6.diocesedesobral100anos.com):vrace (ESTABLISHED) java 22834 elasticsearch 183u IPv6 285311860 0t0 TCP cs24290:42480-\>[host6.diocesedesobral100anos.com](http://host6.diocesedesobral100anos.com):vrace (ESTABLISHED) Why I see connection to [host6.diocesedesobral100anos.com](http://host6.diocesedesobral100anos.com)? Do you know about it? ---
**Author:** ![jasontedor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jasontedor/32/66992_2.png) [@jasontedor](https://discuss.elastic.co/u/jasontedor)\ **Post date:** [November 24, 2017, 10:20pm UTC](https://discuss.elastic.co/t/weird-tcp-connection-to-host6-diocesedesobral100anos-com/109088/2 "2017-11-24T22:20:55Z")
I suspect this is your DNS service giving a reverse DNS lookup that you do not recognize. Instead, you should run: ```auto $ lsof -a -n -P -p ``` This will skip reverse DNS lookup and mapping of port numbers to port names. Then you can see the IP address of the machine that your Elasticsearch instance is connected to (btw, `vrace` maps to port 9300 so that's legitimate). From here, you probably have some investigation to do on _your_ end to find out why reverse DNS lookup is mapping that IP address to a hostname that you do not recognize. Note that that name does not resolve for _us_: ```auto 17:19:49 [jason@totoro:~] $ nslookup host6.diocesedesobral100anos.com Server: 10.10.1.1 Address: 10.10.1.1#53 ** server can't find host6.diocesedesobral100anos.com: NXDOMAIN 17:20:05 [jason@totoro:~] 1 $ ``` ---
**Author:** ![abbasovalex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abbasovalex/32/24667_2.png) [@abbasovalex](https://discuss.elastic.co/u/abbasovalex)\ **Post date:** [November 25, 2017, 1:54pm UTC](https://discuss.elastic.co/t/weird-tcp-connection-to-host6-diocesedesobral100anos-com/109088/3 "2017-11-25T13:54:43Z")
Thank you for fast answer! I will be investigating. BTW, in my case: > nslookup [host6.diocesedesobral100anos.com](http://host6.diocesedesobral100anos.com) > Server: 188.93.16.19 > Address: 188.93.16.19#53 > > \*\* server can't find [host6.diocesedesobral100anos.com](http://host6.diocesedesobral100anos.com): NXDOMAIN ---
**Author:** ![jasontedor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jasontedor/32/66992_2.png) [@jasontedor](https://discuss.elastic.co/u/jasontedor)\ **Post date:** [November 25, 2017, 2:11pm UTC](https://discuss.elastic.co/t/weird-tcp-connection-to-host6-diocesedesobral100anos-com/109088/4 "2017-11-25T14:11:05Z")
Did you run that from the server where Elasticsearch is running and `lsof` is giving you that output? Either way, the course of action is still to run `lsof` without doing reverse name lookups so that you can see the offending IP address. ---
**Author:** ![abbasovalex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abbasovalex/32/24667_2.png) [@abbasovalex](https://discuss.elastic.co/u/abbasovalex)\ **Post date:** [November 27, 2017, 9:53am UTC](https://discuss.elastic.co/t/weird-tcp-connection-to-host6-diocesedesobral100anos-com/109088/5 "2017-11-27T09:53:20Z")
Thank you for your help and assistance! A cause was with PTR on a side my hosting provider. ---
**Author:** ![jasontedor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jasontedor/32/66992_2.png) [@jasontedor](https://discuss.elastic.co/u/jasontedor)\ **Post date:** [November 27, 2017, 3:38pm UTC](https://discuss.elastic.co/t/weird-tcp-connection-to-host6-diocesedesobral100anos-com/109088/6 "2017-11-27T15:38:20Z")
You're welcome. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 25, 2017, 3:38pm UTC](https://discuss.elastic.co/t/weird-tcp-connection-to-host6-diocesedesobral100anos-com/109088/7 "2017-12-25T15:38:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.