Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have ubuntu/hardy server, with kernel 2.6.24-23-server and netstat:

# netstat --version
net-tools 1.60
netstat 1.42 (2001-04-15)

The problem is that we have a lot of ESTABLISHED connections that don't show PID nor Program name in netstat -ntap output. Netstat was called from root, there are no chroots, grsecurity, nor anything like this (or so I was told :).

Any idea on what might be wrong?


lsof -n -i works ok, and shows pid/process name for the connections.

share|improve this question
Are you sure to run it as root or with sudo ? – Dom Nov 17 '09 at 16:02
Yes, it was run on root, and even on root via sudo. same effect. – user13185 Nov 17 '09 at 16:04
Are you sure you were not doing netstat -ntap instead of netstat ntap ? – Kyle Brandt Nov 17 '09 at 17:07
I am sure I was doing netstat -ntap - just as i wrote. as this is the way options are given to netstat according to its man page. – user13185 Nov 17 '09 at 17:14
Side note - i just checked and it seems that netstat doesn't recognize options given without "-". – user13185 Nov 17 '09 at 17:15

This will occur with kernel processes like NFS, but also occasionally occurs with regular apps: RHEL 5 has the same behaviour.

# netstat -taupen | grep 30715
tcp        0      0 *               LISTEN      66558      81467710   - 

Note that lsof, on the other hand, words properly:

# lsof -i:30715
AppName 1598 useracct   78u     IPv4           81467710                   TCP *:30715 (LISTEN)
share|improve this answer

For established connections, this should only happen for connections that are initiated from kernel space, like NFS or DRBD. Obviously waiting connections could have had the process die underneath them. If you can't work out what is causing a given connection, paste the output and someone can tell you what it is.

share|improve this answer
These are definitely not kernel based connections as these are connections to database from application. – user13185 Nov 17 '09 at 16:07
Output of netstat -atnp |grep EST ? – womble Nov 17 '09 at 16:18
this is what my problem is - connections are listed by instead of pid/program name i have "-" – user13185 Nov 17 '09 at 16:25
And I'd like to see what is actually happening, rather than an interpretation thereof. – womble Nov 17 '09 at 16:31
I cannot show you whole output as it contains names that could be used to identify the environment. the line for this particular port looks like this: "tcp 0 0 localhost:36949 localhost:6543 ESTABLISHED -" – user13185 Nov 17 '09 at 17:12

I have the same behaviour and my guess is that netstat behavior may have changed. For example I see the port and program for 'wget', but not for Apache PHP processes, which are the more important to me.

Workaround: I rewrote my script to use lsof instead (see hint above)

share|improve this answer
Pascal: Did you run this command with sudo or as root? – Stefan Lasiewski Jun 7 '10 at 20:27
198_141:~ # netstat  -anp|grep 33000
tcp        0      0 *               LISTEN       -                   
198_141:~ # lsof -i:33000
vsftpd  28147 root    3u  IPv4 4089990174       TCP *:33000 (LISTEN)
198_141:~ # id
uid=0(root) gid=100(users) groups=16(dialout),100(users)
198_141:~ # 

in my oninion,this could be two situations:

1) some normal user excute netstat to see some proces started by root

2) some processes run in kernel

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.