Tagged Questions

netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

0
votes
1answer
387 views

Hundreds of local loopback TIME_WAIT connections on port 7080, Plesk [duplicate]

If I run netstat -tnep I see about two dozen or so regulra connections, then hundreds and hundreds of local loopback conenctions to port 7080. I assume this is something to do with Plesk, but could ...
2
votes
2answers
246 views

When using netstat on a listening port what is the difference between localhost:6666 and [::]:6666 in 'Local Address' field

Using ubuntu 11.04, I run netstat -nplt the results for local address may be localhost:6666 or [::]:6666 What is the difference? I believe that the [::]: binds the service at ...
-1
votes
2answers
5k views

Avoid TIME_WAIT connections [duplicate]

When I use netstat command it shows.. tcp 0 0 localhost:18056 localhost:mysql TIME_WAIT tcp 0 0 localhost:16683 localhost:mysql ...
1
vote
2answers
474 views

Established connection to a blocked port, what does it mean?

I'm pretty new to system administration, and I've been trying to get more familiar with tools like netsat. If I run netstat -n on my server, I see this line: tcp 0 0 xxx.xxx.xxx.xxx:44573 ...
1
vote
2answers
163 views

Averaging dstat output

I need to average upload and download speed using dstat -n. How can I add all the received and sent datas that appear after dstat -n, so that I can add them and find average upload and download ...
0
votes
4answers
107 views

How to I start with a remote IP address connected to my computer to the process that has opened the connection?

If I type "netstat", I can see a list of IP addresses that my PC is connected to. If I start with an IP address, how do I find the process that has opened the connection to said IP address?
1
vote
1answer
133 views

Confusing traffic in netstat, nothing in logs

Just had a confusing couple of minutes! I was monitoring a screen (the gnu screen) running "netstat -a" and I noticed that there was one connection connected to http (port 80), fine. But when I ...
0
votes
1answer
108 views

Port scanning from localhost

I see lot of tcp connections on different ports on my server with 'TIME_WAIT' status. Just simple port scan, but i cant see ip address of this bastard because connections is going from my nginx. Can ...
0
votes
2answers
881 views

Why does netstat show Tomcat process listen to multiple ports?

The netstat output with the tomcat process(pid: 28899) is as followed: Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 ...
1
vote
2answers
2k views

FreeBSD Listen Queue Overflows - can't increase max queue size

I have a decently high trafficked FreeBSD Nginx server, and I'm starting to get a large number of listen queue overflows: [root@svr ~]# netstat -sp tcp | fgrep listen 80361931 listen queue overflows ...
0
votes
1answer
192 views

Netstat shows Time_Wait in MySQL Master to master replication

During my master to master replication, I got a problem on telnet. After fixing it also my replication on both side doesn't work. Master 2 replicates all the database of Master 1 but Master 1 is ...
3
votes
1answer
683 views

Where are my TIME_WAITs on Mac OS X?

No TIME_WAITs on Mac OS X Normally, when a TCP connection is closed, the socket on the side where close() is called first is left in the TIME_WAIT state. When one of the peers is a Mac OS X (Lion) ...
0
votes
3answers
5k views

netstat shows many times deploy.akamaitechnologies.com connected to my server

Many times, after running netstat on my server, I find one of IP addresses belonging to deploy.akamaitechnologies.com connected to my server, do someone has an idea on what is happening on my server ? ...
0
votes
1answer
193 views

netstat outputs same local adress for 2 different connections

Trying to understand how to read netstat output. In my browser I opened site1.com On my server netstat -A inet -p -e outputs the following: tcp 0 0 site1.com:www ...
3
votes
2answers
1k views

linux : netstat listeting queue length

Is there a way to view queue length on listening socket under linux, the same way as netstat -L outputs for freebsd? I.e. you can see X/Y/Z in netstat -L output, but netstat under linux doesn't ...
0
votes
1answer
568 views

Mountain Lion, How can I release port?

$ netstat -ltanp tcp | grep 8000 | grep LISTEN tcp4 0 0 *.8000 *.* LISTEN I want to release this port When I do $ lsof -i:8000 I get nothing I ...
2
votes
2answers
159 views

What does “::” denote in windows netstat results?

I'm trying to understand on which interfaces a TCP port is open Using windows netstat command I get result like : TCP [::]:10000 MyMachineName:0 LISTENING What does ...
1
vote
1answer
478 views

How to remove the hint in the terminal?

As a normal user , when I run some command like ps\netstat, the terminal hint me: (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see ...
1
vote
0answers
210 views

how to get send-q and receive-q on windows server

in linux, is very easy to troubleshoot a remote connection problem because netstat show the send-q and recv-q. This is very useful because we can know if the remote peer is reading the server send ...
3
votes
2answers
2k views

How to determine which TCP/UDP ports are being opened by a given process (linux)?

I know how to do the opposite (find out what process has a given port open) using lsof or netstat, but extensive research on Google hasn't helped me solve the reverse problem. I know I could use ...
1
vote
3answers
1k views

Find whats using all my servers bandwidth

TLDR: how can I dig deeper into my Mac mini OSX server to determine what processes are consuming so much bandwidth, or where all the inbound traffic is coming from? Resource caching is on, all ...
3
votes
1answer
276 views

AIX: is it somehow possible to get a ForeignAddress/PID pair like we are able to get in Linux with netstat?

In Linux (RHEL), we are able to get a ForeignAddress/PID pair with "netstat -ntp" command: [root@rhel ~]# netstat -ntp Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address ...
1
vote
2answers
688 views

Debian iptables, netstate. DDOS? [duplicate]

My server has been timing out and crashing lately. I ran this command: netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n Check the picture for result. ...
2
votes
1answer
675 views

iftop Shows Lots of Mysterious Connections - Not Showing in netstat

I've just stopped all pretty much all services except sshd on my server (Ubuntu Server 10.04), and when I run iftop I get output that looks like this: 12.5Kb 25.0Kb ...
0
votes
1answer
4k views

DDOS Attack detection with netstat [duplicate]

I have a server, today load of my server over 20, i was found a command that detect alive connection to server for DDOS detection and reject IP. netstat -anp | grep 'tcp\|udp' | awk '{print $5}' | ...
1
vote
2answers
286 views

Difference between two netstat results for Apache

We are running RedHat Linux on two front end webservers both running Apache HTTP Server. I have done a diff on both httpd.conf files and there are no differences but the server hostnames. We have ...
2
votes
1answer
3k views

Netstat continuous refresh (watch changes the output)

I am using this simple command to monitor connections (to deal with some recent DOS attacks) on my Debian server: netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n How do I ...
0
votes
1answer
160 views

ss utility does't work properly

I've learned that ss, which is base on netlink, is much faster than netstat when amount of sockets is large. And the secret is here. But when I tested on my suse linux minutes ago, the result ...
4
votes
2answers
728 views

How to know which process was using a port after it enters TIME_WAIT state?

On Linux, is there a way to figure out what process was using a port, before it went into TIME_WAIT state. When I use netstat -tnp I just see two end points, but no process information. Proto Recv-Q ...
-1
votes
0answers
51 views

netstat showing too many connections (Established) [duplicate]

Possible Duplicate: Too Many ESTABLISHED connection from a single IP address in Apache netstat -ntp |grep 80 shows too many ESTABLISHED connection from single IP address. Around 300 of ...
1
vote
3answers
2k views

Too Many ESTABLISHED connection from a single IP address in Apache

netstat -ntp |grep 80 shows too many ESTABLISHED connection from single IP address. Around 300 of them and it is not an attack and user is using a 2G connection to access Apache. This is the case ...
1
vote
1answer
244 views

apache2 won't start yet gives no error [closed]

I'm running apache2 on Debian testing on the Asus Slider sl101 tablet chrooted running on the android kernel. root@hoshi:/# root@hoshi:/# /etc/init.d/apache2 restart Restarting web server: apache2. ...
1
vote
3answers
2k views

Unexplicated ssh connection from localhost through sshd to random localhost's port

I've tried to find out why I had some strange connections on my secure log file. Something like this : Apr 23 11:35:43 li192-61 sshd[11651]: Did not receive identification string from 127.0.0.1 Apr ...
0
votes
2answers
869 views

Why is the port listed only in the specific format of netstat?

I have Tomcat and I am trying to bind to 2 specific ports (using custom connectors). E.g. port A and port B. Problem: When I do netstat -a |grep A I do NOT see the port listed. If I do netstat -antp I ...
0
votes
1answer
236 views

Very strange localhost connections on linux workstation. Need help identifiying the source

The following is the output of netstat on a Ubuntu machine. Can someone help decrypt the output? I am especially curious what the ::1:43213 connection is. Also, why are there so many connections ...
0
votes
1answer
1k views

How to utilise netstat information

We have an application named "Seamer" installed on 2008R2 machine named "R2DUO" which has IP address set as 192.61.247.37 in host file and 172.26.127.40 is IP address of Ethernet card .We have two ...
0
votes
1answer
258 views

fast opening and closing connection with a specific port

We have a Main application named "Trevor" installed in 2008R2 machine named "TEAMER12" which is slow now. One more application named "TVS" also running in and found there were many connections per ...
3
votes
1answer
3k views

Port 80 being used by Microsoft-HTTPAPI/2.0

It's been quite a few days that port is being used by some strange process which i don't know Initially i thought it's related to SQL Server. I tried stopping all the services which starts from SQL ...
1
vote
1answer
245 views

How to find malicious IPs?

Cacti shows irregular and pretty steady high bandwidth to my server (40x the normal) so I guess the server is udnder some sort of DDoS attack. The incoming bandwidth has not paralyzed my server, but ...
1
vote
1answer
461 views

nginx serving .php as static files

ok, again apparently a totally ridiculous problem which I just can't seem to figure out. nginx keeps serving my .php files as static files. I've installed nginx via the repositories on ubuntu. I've ...
3
votes
3answers
614 views

python reports socket in use, netstat and others claim its not

We have a strange socket issue with a RHES3 box: Python 2.4.1 (#1, Jul 5 2005, 19:17:11) [GCC 3.2.3 20030502 (Red Hat Linux 3.2.3-52)] Type "help", "copyright", "credits" or "license" for more ...
3
votes
1answer
512 views

Interpreting Netstat output

I have a LAMP stack running Fedora 12 and I am run the following instruction through the command line on the server: netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | ...
1
vote
2answers
466 views

How to measure bandwidth within the last 15 minutes?

I would like to log my bandwidth into a database and find out when my windows server 2003 is being used the most. I want to feed the database with the bandwidth passed from the last feed (let's say ...
1
vote
1answer
808 views

How to reset netstat -e counters

I would like to reset netstat -e counters. How can I do it? Renewing the network interface may reset these counters, but it is NOT an option - the networking must not be interrupted. My OS is ...
0
votes
1answer
104 views

size of packet icmp with netstat TX

I am confused with the size of packet icmp. I just did a simple initial netstat, where for eth0 : TX-OK = 485 after 1 ping message is send, again I see in netstat TX-OK = 488 So, I just want to know ...
0
votes
1answer
1k views

restart counter in netstat

I am using Ubuntu. I need to count the number of packet received in a specific interface. I found this can be done using netstat. However, I need to count starting from t=zero until a specific time I ...
1
vote
1answer
533 views

netstat -e: high discards and errors

I think my network is congested because of the relatively large discards and errors data. They should be zero or at least close to that. Here is the output of netstat -e on my computer: Interface ...
1
vote
1answer
265 views

What's the difference between Send-Q and S-BCNT in FreeBSD netstat -anx?

What's the exact meaning of Send Buffer byte count in the extended netstat statistics, and why is it always bigger than Send-Q? In other words, what's counted against the S-BCNT that's not counted ...
1
vote
3answers
643 views

Linux : restricting outgoing on an application basis

I typed : netstat -atlpvn and noticed that applications like gedit and python had foreign addresses outside the network (the network being a single computer connected to the internet). Is there ...
1
vote
4answers
2k views

Netstat: How to know if it's Human or Bot/Spider/DDOS

I'm using the following command to check how many connections I have from a single ip netstat -anp |grep ':80' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n If it's DDOS attack(500+ ...