netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

-2
votes
0answers
29 views

Many output tcp connections in SYN_SENT status showed up [duplicate]

I manage some Linux servers, I find a strange phenomenon since last month. When I'm running netstat command, it shows me too many tcp connections point to specific ports like 22 or 80 of different ...
0
votes
0answers
24 views

Netstat count TIME_WAIT connections by port

I can obtain individual TIME_WAIT counts on a port, netstat -nat | grep :11300 | grep TIME_WAIT | wc -l; but how to do this based on all ports eg: 11300 2900 connection 3306 1200 connection ...
0
votes
0answers
28 views

netstat e on windows shows really high bytes count

running netstat /e is giving me strange results "bytes received" from netstat /e output is always way higher, about 10 times higher than when netsh interface ip show subinterfaces is run. wireshark ...
0
votes
0answers
317 views

Windows TCP Port 139 Netbios-ssn vulnerability

I ran netstat -b on my computer. Two results showed that I do not understand, VAIO being another PC on the LAN. [firefox.exe] TCP 192.168.100.106:49186 VAIO:netbios-ssn TIME_WAIT TCP ...
0
votes
0answers
89 views

Cannot Access web Interface https Zimbra from WAN

I have a zimbra 8 installed on Ubuntu 12.04 LTS I can access to web interface (https) from LAN. I just type https://192.168.1.10/ in the Firefox. But if i try to access from other PC to my WAN IP ...
1
vote
2answers
53 views

Difference Between Netstat and Access Log

When I was checking stats in SSH terminal for my VPS, I noticed that netstat and access log gives different results. When I used: netstat -anp I saw that one attacker having 32 concurrent ...
0
votes
1answer
38 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk ...
3
votes
2answers
160 views

After kill -9 process won't disappear and port is still bound

We have a Java server application running on Mac OS X. Occasionally this application has become unresponsive, and we have resorted to killing it with kill -9. However, the process doesn't disappear; ...
0
votes
2answers
127 views

What are records in 'netstat' command are when using logstash?

I use logstash with embedded elasticsearch. My logstash config looks like the following: output { tdout { debug => true debug_format => "json"} elasticsearch { embedded => true ...
1
vote
2answers
50 views

How to find the count of Apache workers' at a given point for shared IPs?

One can find the number of Apache workers an IP address is consuming at an instantaneous point in time by executing: netstat -pantu | grep :80 |sort | uniq -c |grep <IP_HERE, eg: 192.168> | wc ...
1
vote
2answers
127 views

Can I find the list of ports being listened by a process ordered by the time of opening?

I know I can see the list of open ports using the lsof command. I am trying to view the results ordered by timestamp of listening. The process opens multiple (~6) ports and I suspect the order of ...
-3
votes
2answers
51 views

How to get the number of current connections to an external web service [closed]

My application makes many requests in a day to a webservice (say 172.20.20.20:11111) on a different server. I would like to know how I can count the number of connections that are established (the ...
0
votes
2answers
70 views

netstat brought up strange ip

I just ran netstat -vatn and found there was a connection ESTABLISHED on :22 from my ip and another unknown ip. Moments later I ran it again and found the connection was gone. I have a default ...
1
vote
0answers
343 views

What does “connections reset due to unexpected data” in netstat -s mean

I'm running a memcached server under heavy load from multiple web servers. While investigating some odd app level behaviour, we spotted that netstat -s on the memcached box was showing a lot of ...
2
votes
1answer
203 views

Netstat hangs: why?

Sometimes (not too often at all) when I type "netstat", it takes over 5 seconds to return. While other times is instantaneous. I have been observing this for weeks on my server (CentOS 6.4), but I ...
0
votes
1answer
786 views

How does netstat get a hostname from IP while nslookup & nblookup fail every time?

In Windows Server 2003, when I run netstat with no flags, it takes much longer than netstat -n to return results. I realize this is because it has to perform reverse lookups by IP address to get the ...
1
vote
1answer
292 views

Lots of TIME_WAIT from same IP address

I've seen a lot of questions with people concerned about lots of TIME_WAITs in netstat. I'm having a similar problem but all the TIME_WAITs are coming from the same IP address. I get over 200 of the ...
1
vote
1answer
71 views

How to find full process arguments and associated listening ports?

I can execute netstat -atulpn | grep java to find all Java processes with their accompanying ports, which is great, however I would like to also have the processes full execution arguments also shown. ...
2
votes
1answer
134 views

Find number of TCP bytes transmitted

I have rhel4 and rhel6 hosts. I can use netstat -s to see information on the number of segments sent/received. I can use ifconfig to see the number of bytes sent/received on a given interface (for ...
0
votes
1answer
579 views

UDP port appears to be in use but is not shown in netstat or TCPView

I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen ...
1
vote
2answers
262 views

Why is netstat -n different between Solaris and Linux and how can I make it the same?

When I run netstat -n on Solaris I get different results from netstat -n on Linux, even though according to the manual pages in Solaris and Linux the -n flag should do the same thing. My question: ...
1
vote
2answers
81 views

Linux: Find amount of “active” connections on one port

i need to monitor how many users are actively connected to one port on debian. I know i can do it with command netstat -na |grep $port |grep ESTABLISHED |wc -l which really gives me result - a ...
2
votes
1answer
125 views

Cannot install net-tools on Red Hat Linux

The isolated networking lab is running Red Hat Linux 9 (Shrike). We still use this "ancient" release, because given the simplicity of the protocols examined, it is sufficient. In addition, because of ...
0
votes
0answers
71 views

netstat ? Huge buffer build-up

we are seeing the following: The netstat line which shows the buildup: 10:51:34|tcp 4294967258 0 192.20.1.228:53824 192.20.1.228:2500 ESTABLISHED The netstat command used to generate the ...
0
votes
1answer
304 views

Application Unable connect Remote Server. FIREWALL Issue

Developing a C# Application that uses an WDSL/SOAP service and connects to a server via port 443 I know it is a Firewall Windows 2008 Server issue. Because when I disable it, it works perfectly. ...
0
votes
1answer
291 views

Random TCP Resets

We got randomly TCP "reset" error when we send request to remote server. Log from remote server Cisco TCP Connection Terminated,Nov 05 14:43:39 EST: %ASA-session-6-302014: Teardown TCP connection ...
0
votes
1answer
256 views

how to display netstat output on nagios

Can you please tell me how to monitor an established connection (on a specified port) in a windows machine from nagios (centOS) here an example (output of netstat): Proto Local Address ...
0
votes
1answer
109 views

IP routing Solaris 9 access the internet from local network

I am trying to configure the NICS on the Solaris Sparc server. My problem lies in getting out to the "Internet" from the local network. I have requested the NIC to receive a DHCP server address ...
0
votes
1answer
76 views

Strange ports on default install of W7

I have a base new install of windows 7, and when I went to look for something else I saw the attached netstat output. What concerns me is that this is Windows + Truecrypt + drivers, nothing else ...
2
votes
2answers
167 views

Determine from where is “sh” being run under apache www-data user using using PF or NETSTAT [duplicate]

I am working with a compromised Ubuntu 8.04 Plesk 9.5.4 server. It seems that a script on the server is continuously doing reverse lookups to random IPs on the Internet. I first spotted it during by ...
4
votes
2answers
689 views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
1
vote
2answers
83 views

How to map an ephemeral port to a pid?

I have a RHEL server with several apps on it and I am attempting to figure out which one of them is making calls to an external web service. I have TCP dumps that show the calls being made and through ...
0
votes
0answers
208 views

What does given filed mean in netstat -s on Linux

I am analyzing the the output of netstat -s and wanted to know what "input ICMP message failed" is meant for ,below is output of netstat -s Icmp: 643 ICMP messages received 0 input ICMP ...
1
vote
1answer
922 views

Check nginx active connection without HttpStubStatusModule

We want to check the number of active connections without the module HttpStubStatusModule being installed. What would be the equivalent Linux command? As a base line, we test on a machine with ...
0
votes
1answer
169 views

What's the meaning of `netstat -i` flags

When I run netstat -i in Linux, I get outputs like: Kernel Interface table Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg eth0 1500 0 0 0 0 0 ...
0
votes
2answers
486 views

HTTP attack - Too many connections & TIME_WAIT

I am running CentOS 6 with http -2.2.15 Going under HTTP attack, i can see many http process running. > netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n > 1 established) > ...
2
votes
1answer
2k views

Too many established connections left open

I have a (probably quite old) CentOS 4.5 server with a custom java application running inside. I found the application was crashing after some running time and found it was handling 1024 connections ...
0
votes
1answer
388 views

Netstat doesn't work on FreeBSD by php function exec()

In my php-app I need the list of all IP's connected on port 80. I've chosen to do it this way: <?php $ips = exec("netstat -an |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq ...
0
votes
1answer
190 views

Apache2 many CLOSE_WAIT. LAMP. Locating the issue

I've got a LAMP setup running and I seem to have many CLOSE_WAIT connections for apache2 program when I netstat (several hundred). This eventually causes my apache to become unresponsive. Bellow is ...
0
votes
1answer
94 views

Reverse-resolved address ending with .bng?

I routinely check netstat --tcp when ssh'ed into my server, but today found an odd hyphenated address format that I haven't seen before: Proto Recv Sent Local Address Foreign Address ...
0
votes
1answer
366 views

How to check if sockets are sending/receiving data on linux?

I often have to debug processes which involve a server client tcp connection. I'd like to check, during times where a client might seem stuck, whether the server is sending it data or not. I can use: ...
0
votes
1answer
212 views

Find IP addresses with most connections on system

I am currently experiencing some attacks on my OpenVZ server (CentOS 6.3 64bit), which is saturating the public ethernet interface (currently accessing SSH via the private interface). Is it possible ...
3
votes
1answer
95 views

What is a good way to determine a server's connection usage?

Trying to figure out where my system's connections are being used (i.e. how many connections belong to what processes - could even be filtered by some expression through grep, if it applies). The ...
0
votes
1answer
175 views

No response from IIS

My problem is that the Default Web Site can be opened from the server machine (localhost), but cannot be opened from a test machine (which is in the same LAN). Netstat says that IIS 7.5 is listening ...
0
votes
1answer
163 views

How can I find the cause of an unknown connection showing in iftop?

I have connections like this showing frequently in iftop: 12.15.127.75.host.nwnx.net => 121.61.153.172 480b 160b 40b I have no idea ...
1
vote
1answer
333 views

Can't Access CouchDB Remotely

Please keep in mind that I have this installed on an Amazon EC2 instance running the latest version of Ubuntu Server. I have changed the bind_address to 0.0.0.0. netstat -an | grep 5984 yields the ...
1
vote
1answer
177 views

How to see IPs of user using the most SYN_RECV, TIME_WAIT, etc?

Does anyone recommend (or have a netstat script) that will print the IP sending the most of X (where X is FIN_WAIT, SYN_RECV, etc.). Like, I have this netstat -nat | awk '{print $6}' | sort | uniq ...
0
votes
1answer
378 views

Apache creates lots of processes in CLOSE_WAIT state and than crashes

I have a web server (centos) with Apache 2.4.3 and in peak times Apache becomes unresponsive until I restart it. Before it happens there is suddenly spike of httpd proccesses count and it seems that ...
0
votes
1answer
399 views

What does this netstat output mean?

I run a moderately active website on a dedicated server. In the course of protecting against (D)DOS attacks, I ran netstat to get a count of active connections. This produced a rather unusual result ...
0
votes
1answer
177 views

Apache SSL not accepting outside traffic

Running Apache 2 on Ubuntu 11 in Amazon EC2. Tried to add a new SSL VirtualHost by doing the following: Added "Listen 443" to ports.conf. Added new VirtualHost in my enabled site and "SSLEngine on". ...