I'm trying to secure my webserver running tomcat and mysql. My server sends me the following output from netstat every night so I can see what's going on with the ports. The idea is that I show as little as possible in response to hackers and crackers running port scanners.

Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State
PID/Program name tcp 0 0 localhost:8005 *:* LISTEN
2002/java tcp 0 0 localhost:mysql *:* LISTEN
386/mysqld tcp 0 0 *:www *:* LISTEN
2002/java tcp 0 0 *:ssh *:* LISTEN
248/sshd tcp 0 0 *:12121 *:* LISTEN
267/perl tcp 0 0 *:smtp *:* LISTEN
239/master tcp 0 0 *:https *:* LISTEN
2002/java tcp 0 0 localhost:mysql localhost:1462 ESTABLISHED
386/mysqld tcp 1 0 localhost:1449 localhost:mysql CLOSE_WAIT
2002/java tcp 0 0 localhost:1462 localhost:mysql ESTABLISHED
2002/java tcp 1 0 localhost:1415 localhost:mysql CLOSE_WAIT
2002/java tcp 1 0 localhost:1413 localhost:mysql CLOSE_WAIT
2002/java tcp 1 0 localhost:1419 localhost:mysql CLOSE_WAIT
2002/java tcp 1 0 localhost:1417 localhost:mysql CLOSE_WAIT
2002/java tcp 1 0 localhost:1421 localhost:mysql CLOSE_W

What I don't understand is why I've got ports with 'established' and 'close_wait' from java to mysql. Is something up the creek in my configuration? Shouldn't these connections die off, rather than stacking up like this at the rate of one per day?

Thanks Adam