netstat is a tool for viewing active network connections, listeners and sockets.
2
votes
1answer
65 views
Too many established connections left open
I have a (probably quite old) CentOS 4.5 server with a custom java application running inside.
I found the application was crashing after some running time and found it was handling 1024 connections ...
0
votes
1answer
62 views
Netstat doesn't work on FreeBSD by php function exec()
In my php-app I need the list of all IP's connected on port 80. I've chosen to do it this way:
<?php
$ips = exec("netstat -an |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq ...
0
votes
1answer
27 views
Apache2 many CLOSE_WAIT. LAMP. Locating the issue
I've got a LAMP setup running and I seem to have many CLOSE_WAIT connections for apache2 program when I netstat (several hundred). This eventually causes my apache to become unresponsive.
Bellow is ...
0
votes
1answer
43 views
Reverse-resolved address ending with .bng?
I routinely check netstat --tcp when ssh'ed into my server, but today found an odd hyphenated address format that I haven't seen before:
Proto Recv Sent Local Address Foreign Address ...
0
votes
1answer
59 views
How to check if sockets are sending/receiving data on linux?
I often have to debug processes which involve a server client tcp connection. I'd like to check, during times where a client might seem stuck, whether the server is sending it data or not. I can use:
...
0
votes
1answer
49 views
Find IP addresses with most connections on system
I am currently experiencing some attacks on my OpenVZ server (CentOS 6.3 64bit), which is saturating the public ethernet interface (currently accessing SSH via the private interface).
Is it possible ...
3
votes
1answer
39 views
What is a good way to determine a server's connection usage?
Trying to figure out where my system's connections are being used (i.e. how many connections belong to what processes - could even be filtered by some expression through grep, if it applies). The ...
0
votes
1answer
49 views
No response from IIS
My problem is that the Default Web Site can be opened from the server machine (localhost), but cannot be opened from a test machine (which is in the same LAN). Netstat says that IIS 7.5 is listening ...
0
votes
1answer
35 views
How can I find the cause of an unknown connection showing in iftop?
I have connections like this showing frequently in iftop:
12.15.127.75.host.nwnx.net => 121.61.153.172 480b 160b 40b
I have no idea ...
0
votes
1answer
33 views
Can't Access CouchDB Remotely
Please keep in mind that I have this installed on an Amazon EC2 instance running the latest version of Ubuntu Server.
I have changed the bind_address to 0.0.0.0.
netstat -an | grep 5984 yields the ...
0
votes
1answer
61 views
TCPdump / DDoS with CF IPs
My nginx file
http {
set_real_ip_from 204.93.240.0/24;
set_real_ip_from 204.93.177.0/24;
set_real_ip_from 199.27.128.0/21;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
...
1
vote
1answer
40 views
How to see IPs of user using the most SYN_RECV, TIME_WAIT, etc?
Does anyone recommend (or have a netstat script) that will print the IP sending the most of X (where X is FIN_WAIT, SYN_RECV, etc.).
Like, I have this
netstat -nat | awk '{print $6}' | sort | uniq ...
0
votes
1answer
82 views
Apache creates lots of processes in CLOSE_WAIT state and than crashes
I have a web server (centos) with Apache 2.4.3 and in peak times Apache becomes unresponsive until I restart it.
Before it happens there is suddenly spike of httpd proccesses count and it seems that ...
0
votes
1answer
117 views
What does this netstat output mean?
I run a moderately active website on a dedicated server. In the course of protecting against (D)DOS attacks, I ran netstat to get a count of active connections. This produced a rather unusual result ...
0
votes
0answers
190 views
netstat -anp No PID/Program name? [closed]
I am newbie to this,Could someone help ?
I didn't see any PID/PROGRAM name on some process, what could that be the reason ?
# netstat -anp
Active Internet connections (servers and established)
...
0
votes
1answer
48 views
Apache SSL not accepting outside traffic
Running Apache 2 on Ubuntu 11 in Amazon EC2. Tried to add a new SSL VirtualHost by doing the following:
Added "Listen 443" to ports.conf.
Added new VirtualHost in my enabled site and "SSLEngine on".
...
0
votes
1answer
109 views
Hundreds of local loopback TIME_WAIT connections on port 7080, Plesk [duplicate]
If I run netstat -tnep I see about two dozen or so regulra connections, then hundreds and hundreds of local loopback conenctions to port 7080. I assume this is something to do with Plesk, but could ...
2
votes
2answers
70 views
When using netstat on a listening port what is the difference between localhost:6666 and [::]:6666 in 'Local Address' field
Using ubuntu 11.04, I run netstat -nplt the results for local address may be
localhost:6666
or
[::]:6666
What is the difference?
I believe that the [::]: binds the service at ...
-1
votes
2answers
297 views
Avoid TIME_WAIT connections [duplicate]
When I use netstat command it shows..
tcp 0 0 localhost:18056 localhost:mysql TIME_WAIT
tcp 0 0 localhost:16683 localhost:mysql ...
1
vote
2answers
100 views
Established connection to a blocked port, what does it mean?
I'm pretty new to system administration, and I've been trying to get more familiar with tools like netsat. If I run netstat -n on my server, I see this line:
tcp 0 0 xxx.xxx.xxx.xxx:44573 ...
1
vote
2answers
76 views
Averaging dstat output
I need to average upload and download speed using dstat -n.
How can I add all the received and sent datas that appear after dstat -n, so that I can add them and find average upload and download ...
0
votes
4answers
68 views
How to I start with a remote IP address connected to my computer to the process that has opened the connection?
If I type "netstat", I can see a list of IP addresses that my PC is connected to.
If I start with an IP address, how do I find the process that has opened the connection to said IP address?
1
vote
1answer
90 views
Confusing traffic in netstat, nothing in logs
Just had a confusing couple of minutes! I was monitoring a screen (the gnu screen) running "netstat -a" and I noticed that there was one connection connected to http (port 80), fine. But when I ...
0
votes
1answer
73 views
Port scanning from localhost
I see lot of tcp connections on different ports on my server with 'TIME_WAIT' status.
Just simple port scan, but i cant see ip address of this bastard because connections is going from my nginx.
Can ...
0
votes
2answers
336 views
Why does netstat show Tomcat process listen to multiple ports?
The netstat output with the tomcat process(pid: 28899) is as followed:
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 ...
1
vote
2answers
287 views
FreeBSD Listen Queue Overflows - can't increase max queue size
I have a decently high trafficked FreeBSD Nginx server, and I'm starting to get a large number of listen queue overflows:
[root@svr ~]# netstat -sp tcp | fgrep listen
80361931 listen queue overflows
...
0
votes
1answer
99 views
Netstat shows Time_Wait in MySQL Master to master replication
During my master to master replication, I got a problem on telnet. After fixing it also my replication on both side doesn't work. Master 2 replicates all the database of Master 1 but Master 1 is ...
1
vote
1answer
288 views
Where are my TIME_WAITs on Mac OS X?
No TIME_WAITs on Mac OS X
Normally, when a TCP connection is closed, the socket on the side where close() is called first is left in the TIME_WAIT state.
When one of the peers is a Mac OS X (Lion) ...
0
votes
3answers
992 views
netstat shows many times deploy.akamaitechnologies.com connected to my server
Many times, after running netstat on my server, I find one of IP addresses belonging to deploy.akamaitechnologies.com connected to my server, do someone has an idea on what is happening on my server ?
...
0
votes
0answers
55 views
Which port needs to be open to send mail with exim4 only?
I only want to send email from my VPS through exim4.
When I run netstat -anltp | grep "LISTEN" the output is:
tcp 0 0 123.45.789.10:25 0.0.0.0:* LISTEN - ...
0
votes
1answer
103 views
netstat outputs same local adress for 2 different connections
Trying to understand how to read netstat output.
In my browser I opened site1.com
On my server netstat -A inet -p -e outputs the following:
tcp 0 0 site1.com:www ...
1
vote
2answers
422 views
linux : netstat listeting queue length
Is there a way to view queue length on listening socket under linux, the same way as netstat -L outputs for freebsd? I.e. you can see X/Y/Z in netstat -L output, but netstat under linux doesn't ...
0
votes
1answer
514 views
Mountain Lion, How can I release port?
$ netstat -ltanp tcp | grep 8000 | grep LISTEN
tcp4 0 0 *.8000 *.* LISTEN
I want to release this port
When I do
$ lsof -i:8000
I get nothing
I ...
2
votes
2answers
104 views
What does “::” denote in windows netstat results?
I'm trying to understand on which interfaces a TCP port is open
Using windows netstat command I get result like :
TCP [::]:10000 MyMachineName:0 LISTENING
What does ...
1
vote
1answer
167 views
How to remove the hint in the terminal?
As a normal user , when I run some command like ps\netstat, the terminal hint me:
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see ...
1
vote
0answers
103 views
how to get send-q and receive-q on windows server
in linux, is very easy to troubleshoot a remote connection problem because netstat show the send-q and recv-q. This is very useful because we can know if the remote peer is reading the server send ...
3
votes
2answers
899 views
How to determine which TCP/UDP ports are being opened by a given process (linux)?
I know how to do the opposite (find out what process has a given port open) using lsof or netstat, but extensive research on Google hasn't helped me solve the reverse problem.
I know I could use ...
0
votes
0answers
21 views
Send-Q in netstat ouput above 15k
Apache webserver running on ubuntu 11.04 64 bit is not accepting connections and a netstat output shows high values for Send-Q for some connections.
What can be the reason.
Send-Q is high for only ...
1
vote
3answers
627 views
Find whats using all my servers bandwidth
TLDR: how can I dig deeper into my Mac mini OSX server to determine what processes are consuming so much bandwidth, or where all the inbound traffic is coming from?
Resource caching is on, all ...
3
votes
1answer
136 views
AIX: is it somehow possible to get a ForeignAddress/PID pair like we are able to get in Linux with netstat?
In Linux (RHEL), we are able to get a ForeignAddress/PID pair with "netstat -ntp" command:
[root@rhel ~]# netstat -ntp
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address ...
0
votes
1answer
287 views
Debian iptables, netstate. DDOS?
My server has been timing out and crashing lately.
I ran this command:
netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
Check the picture for result. ...
0
votes
1answer
297 views
iftop Shows Lots of Mysterious Connections - Not Showing in netstat
I've just stopped all pretty much all services except sshd on my server (Ubuntu Server 10.04), and when I run iftop I get output that looks like this:
12.5Kb 25.0Kb ...
0
votes
1answer
1k views
DDOS Attack detection with netstat
I have a server, today load of my server over 20, i was found a command that detect alive connection to server for DDOS detection and reject IP.
netstat -anp | grep 'tcp\|udp' | awk '{print $5}' | ...
1
vote
2answers
225 views
Difference between two netstat results for Apache
We are running RedHat Linux on two front end webservers both running Apache HTTP Server.
I have done a diff on both httpd.conf files and there are no differences but the server hostnames. We have ...
1
vote
1answer
741 views
Netstat continuous refresh (watch changes the output)
I am using this simple command to monitor connections (to deal with some recent DOS attacks) on my Debian server:
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
How do I ...
0
votes
1answer
127 views
ss utility does't work properly
I've learned that ss, which is base on netlink, is much faster than netstat when amount of sockets is large. And the secret is here.
But when I tested on my suse linux minutes ago, the result ...
4
votes
2answers
254 views
How to know which process was using a port after it enters TIME_WAIT state?
On Linux, is there a way to figure out what process was using a port,
before it went into TIME_WAIT state.
When I use netstat -tnp I just see two end points, but no process information.
Proto Recv-Q ...
-1
votes
0answers
46 views
netstat showing too many connections (Established) [duplicate]
Possible Duplicate:
Too Many ESTABLISHED connection from a single IP address in Apache
netstat -ntp |grep 80
shows too many ESTABLISHED connection from single IP address. Around 300 of ...
1
vote
3answers
1k views
Too Many ESTABLISHED connection from a single IP address in Apache
netstat -ntp |grep 80 shows too many ESTABLISHED connection from single IP address. Around 300 of them and it is not an attack and user is using a 2G connection to access Apache. This is the case ...
1
vote
1answer
181 views
apache2 won't start yet gives no error [closed]
I'm running apache2 on Debian testing on the Asus Slider sl101 tablet chrooted running on the android kernel.
root@hoshi:/#
root@hoshi:/# /etc/init.d/apache2 restart
Restarting web server: apache2.
...
