netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

-2
votes
0answers
19 views

High number of connections from own server [on hold]

When I run this command netstat -anp | grep tcp | awk '{print $5}' | cut -f 1 -d : | sort | uniq -c | sort -n it returns something like this ... 5 86.71.61.61 6 81.251.16.217 6 89.2.18.19 9 ...
2
votes
1answer
146 views

lsof doesn't show the established TCP connection

On my system, if I run the netstat for a port, it returns: $ netstat -nat | grep "60964" tcp 0 0 192.0.0.1:60964 0.0.0.0:* LISTEN tcp 59 0 ...
2
votes
1answer
47 views

Is it possible to deterministically trace how port 80 is forwarded and where the configuration is on a given system?

Is there a way to determine or trace how a port forwarding configuration is set up on a system running Ubuntu 14.04 LTS, on which there is a NodeJS service running and somehow accepting connections ...
2
votes
1answer
30 views

Does the netstat counter wrap around? And over what period are they collected?

If I run netstat -s on my solaris 10 box, I got a lot of network statistics. Are these counters since the time of system boot, or some other arbitrary period? And some of the numbers are quite ...
0
votes
1answer
53 views

SSH Tunnel not working

I have a number of SSH tunnels set up between our company's server (hosts website) and our customer's servers (hosts database). For all sites but one the connection is relatively stable however one ...
0
votes
1answer
38 views

How to use non-deprecated tools like ss to get process id running on a port?

I am looking for a non-deprecated way of running a command like netstat -tulpn | grep 8000 to output information about an active port. Any suggestions on how to use a tool like ss to get the process ...
-1
votes
1answer
69 views

Too large 127.0.0.1 connections with nginx - apache2 [duplicate]

I use nginx as proxy-server apache2 and I have a problem with netstat output: $ netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n 5 109.195.36.169 6 109.195.33.205 8 ...
-1
votes
1answer
77 views

Does “ESTABLISHED” state in netstat command for the sshd program mean they actually have access?

I have this person(or bot) from an IP in Chile which has an "ESTABLISHED" connection to SSHD as root on my server. I'm trying to understand what netstat's outputs really mean, the manual doesn't ...
1
vote
2answers
36 views

See stats of data in and out of each connection to a port

I have an application listening to a port. The clients connect to it using http connection. At any given time I see around 3000 connections established. I assume not all these connections are in use ...
0
votes
1answer
26 views

Concurrent connections per IP

I need to make a few changes to a firewall configuration, but before I do I'd like to see the number of concurrent Apache connections per IP. This command produces a nice list: #netstat -ntu | awk ...
0
votes
2answers
64 views

Print last column containing spaces and special characters

I need a full path/command thats been execued to start a process thats exposed on the network - listens on tcp/udp . I did manage to get all of that using below "one liner": netstat -nlp46|tail -n +3 ...
2
votes
1answer
125 views

Is it normal to have many connections from my own server ip when I ran netstat command?

I would like to know if is it normal to have many connections from my own server ip when I ran: netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | ...
1
vote
0answers
68 views

Why is SQL Server using all ephemeral ports connecting to itself and causing TIME_WAITs?

I've got an AWS server with Windows 2008 R2, SQL Server 2012, and Tomcat 7. When I run netstat -ano the screen is flooded with TIME_WAIT. I posted the output in a Gist. When I run CurrPorts, filter ...
1
vote
0answers
123 views

TCP High Send-q coupled with FIN_WAIT1 status

I'm having a problem with one of my webservers, which is taking minutes to completely render a web page. I had a look at the TCP connection and noticed that I have a very high value in the send-q ...
0
votes
0answers
99 views

No connection available in pool. netstat RecvQ shows high number

In our servers there is one particular dependency (java jar), which makes a total of 1024 connection to various remote servers (the library works as a service discovery). Intermittently, it is ...
0
votes
1answer
702 views

Nginx not running with no error message (ubuntu 14.04 lts)

I am trying to start my nginx server. When I type "$> /etc/init.d/nginx start", I have a message appearing "Starting nginx: Ok", and then nothing happens. When I type "sudo lsof -nP -i | grep ...
4
votes
2answers
795 views

How to make netstat on Linux only show OUTBOUND tcp connections?

My ubuntu server is infected and there is a process making a bunch of HTTP requests to a bunch of websites (sucks!). I have added the following to my firewall (UFW): sudo ufw deny out proto tcp to ...
0
votes
0answers
29 views

netstat output without PID

I just stumbled across this issue with the netstat output on my server, There are a couple of ports which are listening, but do not have a PID attached to it. I want to make sure they are not ...
1
vote
1answer
209 views

Port suddenly closed. How to re-open?

I've written a software module in PHP that manages the saving of data in different data stores (MySQL, ElasticSearch and Redis). To test the module, I've created several test plans in Apache JMeter, ...
2
votes
2answers
114 views

Limit to number of listening ports in linux

I have tried to launch a script to listen to thousands of tcp ports (1000 to 10000) but it appears to be hitting a limit of 1024 listening ports. I've confirmed this via netstat and closed ports above ...
1
vote
0answers
41 views

How to check a given connection has been offloaded to network card

From what I read, some part of the tcp protocol operation can be offloaded from kernel to network card driver thanks to TOE (or GSO, LSO, LRO..). My objective is too find if a given socket has some ...
0
votes
1answer
60 views

Simulation of TX/RX Drop

I'm trying to get the "TX/RX Drop" values to increase. I've tried dropping packets using both iperf and iptables but the statistics aren't increasing even when packets are being dropped. Is there a ...
1
vote
0answers
77 views

iptables traffic after forwarding

I have 2 servers Server A and Server B ServerA = 1.1.1.1 ServerB = 2.2.2.2 I am using ip-tables to send all traffic on port 80 to Server B on Server (A) 1.1.1.1 i have done iptables -t nat -A ...
0
votes
0answers
94 views

Ghost tcp connections: ss sees them, nothing else does

We have a strange problem. Our remote server shows over 900 connections coming from our office over port 80: # ss -n | grep ESTAB | grep $OFFICEIP | grep :80 | wc -l 935 Netstat shows a similar ...
0
votes
2answers
131 views

Display IP & TCP statistics per interface (netstat -s with interface)

Linux has the ability to display protocol statistics with netstat -s. The output looks something like: Excerpt: 7487 times unabled to send RST due to no memory TCPDSACKIgnoredOld: 817 ...
1
vote
1answer
148 views

Limit Number of TCP connections in Linux Server, to avoid attack

I want to limit the number of TCP connections in Linux server, I have used the following command. iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 25 --connlimit-mask 32 ...
0
votes
1answer
104 views

Port 80 doesn't work

I have a website in my ubuntu server 14.04, with apache2 server, and untils fews days go the site works fine but, today if I digit www.mydomain.com from my internal network it works but, if I try with ...
1
vote
5answers
258 views

Get number of TCP established connections

On a Linux server one can use netstat -tan | grep ESTABLISHED| wc -l but this will not work on a high load server with watch -n1. Such approach works fine if the server is not very busy or the ...
0
votes
1answer
281 views

What causes “SYN to LISTEN sockets dropped”?

A quite busy proxy server has lots of "SYNs to LISTEN sockets dropped". I learned one cause could be a too small backlog size. But in that case the "times the listen queue of a socket overflowed" ...
0
votes
0answers
83 views

xinetd stops working in Debian Wheezy

We have a server with a whois service running. The whois service is provided by xinetd. The configuration file /etc/xinetd.d/whois looks like this: service whois { socket_type = stream ...
1
vote
4answers
287 views

Is there a netstat -s equivalent for windows?

I know that netstat -s exists on Windows, but it displays way less informations than on Linux/OS X. It only gives 8 counters about TCP, while on Linux it's more than 50. I'm looking for any ...
3
votes
1answer
160 views

What does it mean for netstat -t

I see the help of netstat -t option says Displays the current connection offload state. And I tried it in the windows command console. The Offload State value display InHost. What does Offload ...
0
votes
2answers
701 views

Netstat count TIME_WAIT connections by port

I can obtain individual TIME_WAIT counts on a port, netstat -nat | grep :11300 | grep TIME_WAIT | wc -l; but how to do this based on all ports eg: 11300 2900 connection 3306 1200 connection ...
0
votes
0answers
119 views

netstat e on windows shows really high bytes count

running netstat /e is giving me strange results "bytes received" from netstat /e output is always way higher, about 10 times higher than when netsh interface ip show subinterfaces is run. wireshark ...
0
votes
0answers
3k views

Windows TCP Port 139 Netbios-ssn vulnerability

I ran netstat -b on my computer. Two results showed that I do not understand, VAIO being another PC on the LAN. [firefox.exe] TCP 192.168.100.106:49186 VAIO:netbios-ssn TIME_WAIT TCP ...
1
vote
2answers
102 views

Difference Between Netstat and Access Log

When I was checking stats in SSH terminal for my VPS, I noticed that netstat and access log gives different results. When I used: netstat -anp I saw that one attacker having 32 concurrent ...
0
votes
1answer
87 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk ...
3
votes
2answers
257 views

After kill -9 process won't disappear and port is still bound

We have a Java server application running on Mac OS X. Occasionally this application has become unresponsive, and we have resorted to killing it with kill -9. However, the process doesn't disappear; ...
0
votes
2answers
377 views

What are records in 'netstat' command are when using logstash?

I use logstash with embedded elasticsearch. My logstash config looks like the following: output { tdout { debug => true debug_format => "json"} elasticsearch { embedded => true ...
1
vote
2answers
142 views

How to find the count of Apache workers' at a given point for shared IPs?

One can find the number of Apache workers an IP address is consuming at an instantaneous point in time by executing: netstat -pantu | grep :80 |sort | uniq -c |grep <IP_HERE, eg: 192.168> | wc ...
1
vote
2answers
247 views

Can I find the list of ports being listened by a process ordered by the time of opening?

I know I can see the list of open ports using the lsof command. I am trying to view the results ordered by timestamp of listening. The process opens multiple (~6) ports and I suspect the order of ...
-3
votes
2answers
63 views

How to get the number of current connections to an external web service [closed]

My application makes many requests in a day to a webservice (say 172.20.20.20:11111) on a different server. I would like to know how I can count the number of connections that are established (the ...
0
votes
2answers
178 views

netstat brought up strange ip

I just ran netstat -vatn and found there was a connection ESTABLISHED on :22 from my ip and another unknown ip. Moments later I ran it again and found the connection was gone. I have a default ...
1
vote
0answers
493 views

What does “connections reset due to unexpected data” in netstat -s mean

I'm running a memcached server under heavy load from multiple web servers. While investigating some odd app level behaviour, we spotted that netstat -s on the memcached box was showing a lot of ...
4
votes
1answer
956 views

Netstat hangs: why?

Sometimes (not too often at all) when I type "netstat", it takes over 5 seconds to return. While other times is instantaneous. I have been observing this for weeks on my server (CentOS 6.4), but I ...
0
votes
2answers
2k views

How does netstat get a hostname from IP while nslookup & nblookup fail every time?

In Windows Server 2003, when I run netstat with no flags, it takes much longer than netstat -n to return results. I realize this is because it has to perform reverse lookups by IP address to get the ...
1
vote
1answer
664 views

Lots of TIME_WAIT from same IP address

I've seen a lot of questions with people concerned about lots of TIME_WAITs in netstat. I'm having a similar problem but all the TIME_WAITs are coming from the same IP address. I get over 200 of the ...
2
votes
1answer
169 views

How to find full process arguments and associated listening ports?

I can execute netstat -atulpn | grep java to find all Java processes with their accompanying ports, which is great, however I would like to also have the processes full execution arguments also shown. ...
2
votes
1answer
291 views

Find number of TCP bytes transmitted

I have rhel4 and rhel6 hosts. I can use netstat -s to see information on the number of segments sent/received. I can use ifconfig to see the number of bytes sent/received on a given interface (for ...
1
vote
1answer
2k views

UDP port appears to be in use but is not shown in netstat or TCPView

I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen ...