Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Novell Linux server used for Novell Access Gateway. When I run netstat -a I get thousands of CLOSE_WAIT state connections from localhost:xxxx to localhost:snpp.

1st question how can I trace the connection to its source. Source being the executable causing it.

2nd question is that normal for this kind of server? I'm reading about SNPP online and all I see is it's a pager related protocol. I'm not doing anything pager related on this server.


share|improve this question
up vote 0 down vote accepted

You almost had it with netstat, try netstat -ape

  • -a for all listening & non-listening sockets
  • -p to show the PID (and name) of the application that created the sockets
  • -e show extra information (can't hurt)

SNPP could be a false alarm, with out -n netstat will automatically lookup the port number (SNPP is port 444) and return the name, as defined in /etc/services

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.