Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Trying to understand how to read netstat output.

In my browser I opened site1.com

On my server netstat -A inet -p -e outputs the following:

tcp        0      0 site1.com:www     foreign-adress:37991 ESTABLISHED www-data   94215       19880/apache2

No when I open site2.com in my browser and run netstat -A inet -p -e again I get the output:

tcp        0      0 site1.com:www     foreign-adress:37991 ESTABLISHED www-data   94215       19880/apache2   
tcp        0      0 site1.com:www     foreign-adress:37992 ESTABLISHED www-data   93034       19879/apache2 

Now why isn't netstat showing:

tcp        0      0 site1.com:www     foreign-adress:37991 ESTABLISHED www-data   94215       19880/apache2   
tcp        0      0 site2.com:www     foreign-adress:37992 ESTABLISHED www-data   93034       19879/apache2 

as I have two connections to this server through site1.com and site2.com

Is this something I misconfigured on my server?

Thanks in advance for any help

share|improve this question
    
Are site1 and site2 sharing the same IP-address, are those two vhosts? That would explain it, since netstat only knows about IP-addresses. –  Alexander Janssen Oct 3 '12 at 16:47
    
Ah ok, yes have the same ip. Do you know why netstat is picking site1.com and not site2.com? –  Under435 Oct 3 '12 at 17:03

1 Answer 1

up vote 1 down vote accepted

Since site1 and site2 are sharing the same IP-address I can answer your last comment here. Netstat only knows about IP-addresses. If you ommit the -n parameter, netstat will do a reverese lookup in DNS or your hosts file. Snce one IP-address can only have one IN PTR record, it can only show one hostname.

You may have:

site1.com has 1.2.3.4
site2.com is a CNAME alias on site1.com
1.2.3.4 is site1.com

It's how DNS is supposed to work.

The remote webserver differentiates the requests by the Host: HTTP-header to know what content to serve.

share|improve this answer
    
-n showed the public ip of the server. Thanks for your answer :) –  Under435 Oct 3 '12 at 17:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.