netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

0
votes
0answers
16 views

Ubuntu/Apache2 - Virtual host stops my MySQL server

I have really strange problem. I have an Apache2 server on Ubuntu 14.04 with installed MySQL server. Everything was working fine. I have multiple domains hosted on one server and i believe i received ...
-2
votes
0answers
26 views

PLC actively refusing connection

I have a problem building a TCP connection between a PC a PLC. In short words: The PLC is waiting for connection attempts of the PC. The PLC has a static IP and two Ports (3011 and 3021) I can ...
-1
votes
1answer
38 views

Why when i use netstat while not connected to internet, it returns some ip addresses?

I read that this command displays network connections for the Transmission Control Protocol more info link netstat ,but when i not connected to internet and i turn off XAMMP server,it returns some ...
0
votes
0answers
18 views

How to diagnose netstat: no namelist

I had to replace an NIC on my HP Proliant Microserver, running FreeNAS 9.3 In my crashplan jail, I now get "netstat: no namelist" as a response when I execute the netstat command. How to I diagnose ...
-2
votes
0answers
29 views

netstat and retrieving user ip behind cloudflare

Im wondering if its possible to retrieve user ip behind cloudflare (HTTP_CF_CONNECTING_IP header) with netstat netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
0
votes
1answer
24 views

Netcat - socket in time_wait when echoing and piping, but not when invoked directly

I'm testing an application using netcat (nc) and I'm getting very low throughput on network connections. When I ran netstat -tnpo I see numerous TCP sessions in TIME_WAIT. I'm sending data to my ...
0
votes
1answer
42 views

nmap shows strange open ports

Running nmap on my localhost shows me strange open ports: $ nmap -p- localhost Starting Nmap 6.47 ( http://nmap.org ) at 2015-12-28 12:14 CET Nmap scan report for localhost (127.0.0.1) Host is up ...
0
votes
2answers
60 views

Matching an IP address to a hostname when both are available but cannot be resolved

I am an administrator on a server that accepts RDP connections. When the client connects I know the client's computer name. Using netstat I can determine which connections have been established for ...
0
votes
1answer
28 views

How to Terminate specific TCP sessions without tcpkill

I found lot of TCP connections(listed through netstat) from my Linux server to windows server. I want to kill those sessions without tcpkill cmd how can I ? Please advise ..
0
votes
0answers
18 views

netstat -r on debian give abnormal output

after looking for stuff with Debian "netstat" and try list stuff with "nestat -r" my main Server out a Long list of unkown Hosts ( mostly hacked IP´s by looking on abuseDB ) here a small example for ...
0
votes
0answers
51 views

Monitor outgoing web traffic sources on CentOS [duplicate]

I received a report today that a server I manage (Centos + Apache) is launching a bruteforce attack against wordpress websites: hacked-joomla/brobot The requests sent look like this: x.x.x.x - - ...
2
votes
0answers
48 views

cannot bind a port altough LISTEN

I'm new to this problem I'm using Ubuntu 12.04 LTS via VMware My problem is to bind port 6703 i tried alot of commands to check if this port or open or not Error Message is Failed to bind to: ...
1
vote
0answers
20 views

How do you write the following command : if (netstat flag ==UG ) save addres IP [closed]

how How do you write the following command in ubuntu : if (netstat flag ==UG ) thene addres ip > new file I want to file contains : addres ip 152.123.12.1 123.12.12.123 ...
0
votes
0answers
22 views

CentOS 6.6 rogue mail process? Server sending spam [duplicate]

Our server has been recently compromised and was sending spam emails. We've found the php scripts responsible, eliminated them, and updated the postfix configuration. Problem is that when we ran the ...
-1
votes
2answers
152 views

netstat on unix server shows strange connections

netstat is showing a lot of unknown connections from different strange places. are they just attempt to establish connection? or is my server compromised? I've removed my local addresses from the log ...
2
votes
1answer
27 views

iptable block outbound traffic for which binary?

Presently iptables is blocking all outbound traffic except for a few known/approved services. iptables logs a sample of each time it blocks (2/min), I am trying to figure out what is making the ...
0
votes
0answers
89 views

IPA Server installation: Error with port number

When I am trying to install IPA server, I am getting the following error : IPA requires port 8443 for PKI but it is currently in use. Aborting installation I checked with netstat -tuplen | grep ...
1
vote
1answer
163 views

Netstat showing multiple connections for on ssh login

I connect to my server via ssh. I am the only person who has access to connect to the server. After connecting via ssh, I run the following command: sudo netstat -tupn The output includes the ...
1
vote
3answers
324 views

Is postfix the only program that should be using port 25

My server IP was blacklisted for sending out spam and I am tracking down the program sending spam. I did netstat, and it shows a lot of programs using port 25 e.g tcp 0 182 ...
0
votes
0answers
486 views

Synology open for Cloud Station even if blocking 6690 port

I have a NAS Synology beyong my Internet Box. On the Internet Box, I have UPnP not activated and I have only activated on Port Transfer the following ports : 1701/UDP, 500/UDP and 4500/UDP which are ...
1
vote
0answers
55 views

What exactly constitutes a bad TCP segment?

What constitutes a bad segment as in bad segments received in the netstat output below? I would think a TCP header's checksum could do it, but are there other things? If a segment arrives after its ...
2
votes
2answers
260 views

lsof doesn't show the established TCP connection

On my system, if I run the netstat for a port, it returns: $ netstat -nat | grep "60964" tcp 0 0 192.0.0.1:60964 0.0.0.0:* LISTEN tcp 59 0 ...
2
votes
1answer
53 views

Is it possible to deterministically trace how port 80 is forwarded and where the configuration is on a given system?

Is there a way to determine or trace how a port forwarding configuration is set up on a system running Ubuntu 14.04 LTS, on which there is a NodeJS service running and somehow accepting connections ...
2
votes
1answer
43 views

Does the netstat counter wrap around? And over what period are they collected?

If I run netstat -s on my solaris 10 box, I got a lot of network statistics. Are these counters since the time of system boot, or some other arbitrary period? And some of the numbers are quite ...
0
votes
1answer
175 views

SSH Tunnel not working

I have a number of SSH tunnels set up between our company's server (hosts website) and our customer's servers (hosts database). For all sites but one the connection is relatively stable however one ...
0
votes
1answer
100 views

How to use non-deprecated tools like ss to get process id running on a port?

I am looking for a non-deprecated way of running a command like netstat -tulpn | grep 8000 to output information about an active port. Any suggestions on how to use a tool like ss to get the process ...
-1
votes
1answer
140 views

Too large 127.0.0.1 connections with nginx - apache2 [duplicate]

I use nginx as proxy-server apache2 and I have a problem with netstat output: $ netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n 5 109.195.36.169 6 109.195.33.205 8 ...
-1
votes
1answer
413 views

Does “ESTABLISHED” state in netstat command for the sshd program mean they actually have access?

I have this person(or bot) from an IP in Chile which has an "ESTABLISHED" connection to SSHD as root on my server. I'm trying to understand what netstat's outputs really mean, the manual doesn't ...
1
vote
2answers
40 views

See stats of data in and out of each connection to a port

I have an application listening to a port. The clients connect to it using http connection. At any given time I see around 3000 connections established. I assume not all these connections are in use ...
0
votes
1answer
71 views

Concurrent connections per IP

I need to make a few changes to a firewall configuration, but before I do I'd like to see the number of concurrent Apache connections per IP. This command produces a nice list: #netstat -ntu | awk ...
0
votes
2answers
96 views

Print last column containing spaces and special characters

I need a full path/command thats been execued to start a process thats exposed on the network - listens on tcp/udp . I did manage to get all of that using below "one liner": netstat -nlp46|tail -n +3 ...
2
votes
2answers
329 views

Is it normal to have many connections from my own server ip when I ran netstat command?

I would like to know if is it normal to have many connections from my own server ip when I ran: netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | ...
2
votes
0answers
123 views

Why is SQL Server using all ephemeral ports connecting to itself and causing TIME_WAITs?

I've got an AWS server with Windows 2008 R2, SQL Server 2012, and Tomcat 7. When I run netstat -ano the screen is flooded with TIME_WAIT. I posted the output in a Gist. When I run CurrPorts, filter ...
1
vote
0answers
203 views

TCP High Send-q coupled with FIN_WAIT1 status

I'm having a problem with one of my webservers, which is taking minutes to completely render a web page. I had a look at the TCP connection and noticed that I have a very high value in the send-q ...
0
votes
0answers
225 views

No connection available in pool. netstat RecvQ shows high number

In our servers there is one particular dependency (java jar), which makes a total of 1024 connection to various remote servers (the library works as a service discovery). Intermittently, it is ...
0
votes
2answers
2k views

Nginx not running with no error message (ubuntu 14.04 lts)

I am trying to start my nginx server. When I type "$> /etc/init.d/nginx start", I have a message appearing "Starting nginx: Ok", and then nothing happens. When I type "sudo lsof -nP -i | grep ...
4
votes
2answers
3k views

How to make netstat on Linux only show OUTBOUND tcp connections?

My ubuntu server is infected and there is a process making a bunch of HTTP requests to a bunch of websites (sucks!). I have added the following to my firewall (UFW): sudo ufw deny out proto tcp to ...
0
votes
0answers
40 views

netstat output without PID

I just stumbled across this issue with the netstat output on my server, There are a couple of ports which are listening, but do not have a PID attached to it. I want to make sure they are not ...
1
vote
1answer
444 views

Port suddenly closed. How to re-open?

I've written a software module in PHP that manages the saving of data in different data stores (MySQL, ElasticSearch and Redis). To test the module, I've created several test plans in Apache JMeter, ...
2
votes
2answers
160 views

Limit to number of listening ports in linux

I have tried to launch a script to listen to thousands of tcp ports (1000 to 10000) but it appears to be hitting a limit of 1024 listening ports. I've confirmed this via netstat and closed ports above ...
1
vote
0answers
58 views

How to check a given connection has been offloaded to network card

From what I read, some part of the tcp protocol operation can be offloaded from kernel to network card driver thanks to TOE (or GSO, LSO, LRO..). My objective is too find if a given socket has some ...
0
votes
1answer
73 views

Simulation of TX/RX Drop

I'm trying to get the "TX/RX Drop" values to increase. I've tried dropping packets using both iperf and iptables but the statistics aren't increasing even when packets are being dropped. Is there a ...
1
vote
0answers
126 views

iptables traffic after forwarding

I have 2 servers Server A and Server B ServerA = 1.1.1.1 ServerB = 2.2.2.2 I am using ip-tables to send all traffic on port 80 to Server B on Server (A) 1.1.1.1 i have done iptables -t nat -A ...
0
votes
0answers
168 views

Ghost tcp connections: ss sees them, nothing else does

We have a strange problem. Our remote server shows over 900 connections coming from our office over port 80: # ss -n | grep ESTAB | grep $OFFICEIP | grep :80 | wc -l 935 Netstat shows a similar ...
0
votes
2answers
306 views

Display IP & TCP statistics per interface (netstat -s with interface)

Linux has the ability to display protocol statistics with netstat -s. The output looks something like: Excerpt: 7487 times unabled to send RST due to no memory TCPDSACKIgnoredOld: 817 ...
1
vote
1answer
181 views

Limit Number of TCP connections in Linux Server, to avoid attack

I want to limit the number of TCP connections in Linux server, I have used the following command. iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 25 --connlimit-mask 32 ...
0
votes
1answer
135 views

Port 80 doesn't work

I have a website in my ubuntu server 14.04, with apache2 server, and untils fews days go the site works fine but, today if I digit www.mydomain.com from my internal network it works but, if I try with ...
1
vote
5answers
609 views

Get number of TCP established connections

On a Linux server one can use netstat -tan | grep ESTABLISHED| wc -l but this will not work on a high load server with watch -n1. Such approach works fine if the server is not very busy or the ...
0
votes
1answer
583 views

What causes “SYN to LISTEN sockets dropped”?

A quite busy proxy server has lots of "SYNs to LISTEN sockets dropped". I learned one cause could be a too small backlog size. But in that case the "times the listen queue of a socket overflowed" ...
1
vote
4answers
320 views

Is there a netstat -s equivalent for windows?

I know that netstat -s exists on Windows, but it displays way less informations than on Linux/OS X. It only gives 8 counters about TCP, while on Linux it's more than 50. I'm looking for any ...