netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

1
vote
2answers
952 views

Debian iptables, netstate. DDOS? [duplicate]

My server has been timing out and crashing lately. I ran this command: netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n Check the picture for result. ...
2
votes
1answer
861 views

iftop Shows Lots of Mysterious Connections - Not Showing in netstat

I've just stopped all pretty much all services except sshd on my server (Ubuntu Server 10.04), and when I run iftop I get output that looks like this: 12.5Kb 25.0Kb ...
0
votes
1answer
5k views

DDOS Attack detection with netstat [duplicate]

I have a server, today load of my server over 20, i was found a command that detect alive connection to server for DDOS detection and reject IP. netstat -anp | grep 'tcp\|udp' | awk '{print $5}' | ...
1
vote
2answers
301 views

Difference between two netstat results for Apache

We are running RedHat Linux on two front end webservers both running Apache HTTP Server. I have done a diff on both httpd.conf files and there are no differences but the server hostnames. We have ...
2
votes
1answer
7k views

Netstat continuous refresh (watch changes the output)

I am using this simple command to monitor connections (to deal with some recent DOS attacks) on my Debian server: netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n How do I ...
0
votes
1answer
164 views

ss utility does't work properly

I've learned that ss, which is base on netlink, is much faster than netstat when amount of sockets is large. And the secret is here. But when I tested on my suse linux minutes ago, the result ...
4
votes
2answers
978 views

How to know which process was using a port after it enters TIME_WAIT state?

On Linux, is there a way to figure out what process was using a port, before it went into TIME_WAIT state. When I use netstat -tnp I just see two end points, but no process information. Proto Recv-Q ...
-1
votes
0answers
52 views

netstat showing too many connections (Established) [duplicate]

Possible Duplicate: Too Many ESTABLISHED connection from a single IP address in Apache netstat -ntp |grep 80 shows too many ESTABLISHED connection from single IP address. Around 300 of ...
1
vote
3answers
2k views

Too Many ESTABLISHED connection from a single IP address in Apache

netstat -ntp |grep 80 shows too many ESTABLISHED connection from single IP address. Around 300 of them and it is not an attack and user is using a 2G connection to access Apache. This is the case ...
1
vote
1answer
297 views

apache2 won't start yet gives no error [closed]

I'm running apache2 on Debian testing on the Asus Slider sl101 tablet chrooted running on the android kernel. root@hoshi:/# root@hoshi:/# /etc/init.d/apache2 restart Restarting web server: apache2. ...
1
vote
3answers
2k views

Unexplicated ssh connection from localhost through sshd to random localhost's port

I've tried to find out why I had some strange connections on my secure log file. Something like this : Apr 23 11:35:43 li192-61 sshd[11651]: Did not receive identification string from 127.0.0.1 Apr ...
0
votes
2answers
1k views

Why is the port listed only in the specific format of netstat?

I have Tomcat and I am trying to bind to 2 specific ports (using custom connectors). E.g. port A and port B. Problem: When I do netstat -a |grep A I do NOT see the port listed. If I do netstat -antp I ...
0
votes
1answer
257 views

Very strange localhost connections on linux workstation. Need help identifiying the source

The following is the output of netstat on a Ubuntu machine. Can someone help decrypt the output? I am especially curious what the ::1:43213 connection is. Also, why are there so many connections ...
0
votes
1answer
1k views

How to utilise netstat information

We have an application named "Seamer" installed on 2008R2 machine named "R2DUO" which has IP address set as 192.61.247.37 in host file and 172.26.127.40 is IP address of Ethernet card .We have two ...
0
votes
1answer
345 views

fast opening and closing connection with a specific port

We have a Main application named "Trevor" installed in 2008R2 machine named "TEAMER12" which is slow now. One more application named "TVS" also running in and found there were many connections per ...
4
votes
1answer
5k views

Port 80 being used by Microsoft-HTTPAPI/2.0

It's been quite a few days that port is being used by some strange process which i don't know Initially i thought it's related to SQL Server. I tried stopping all the services which starts from SQL ...
1
vote
1answer
275 views

How to find malicious IPs?

Cacti shows irregular and pretty steady high bandwidth to my server (40x the normal) so I guess the server is udnder some sort of DDoS attack. The incoming bandwidth has not paralyzed my server, but ...
1
vote
1answer
524 views

nginx serving .php as static files

ok, again apparently a totally ridiculous problem which I just can't seem to figure out. nginx keeps serving my .php files as static files. I've installed nginx via the repositories on ubuntu. I've ...
3
votes
3answers
752 views

python reports socket in use, netstat and others claim its not

We have a strange socket issue with a RHES3 box: Python 2.4.1 (#1, Jul 5 2005, 19:17:11) [GCC 3.2.3 20030502 (Red Hat Linux 3.2.3-52)] Type "help", "copyright", "credits" or "license" for more ...
3
votes
1answer
588 views

Interpreting Netstat output

I have a LAMP stack running Fedora 12 and I am run the following instruction through the command line on the server: netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | ...
1
vote
2answers
542 views

How to measure bandwidth within the last 15 minutes?

I would like to log my bandwidth into a database and find out when my windows server 2003 is being used the most. I want to feed the database with the bandwidth passed from the last feed (let's say ...
1
vote
1answer
1k views

How to reset netstat -e counters

I would like to reset netstat -e counters. How can I do it? Renewing the network interface may reset these counters, but it is NOT an option - the networking must not be interrupted. My OS is ...
0
votes
1answer
109 views

size of packet icmp with netstat TX

I am confused with the size of packet icmp. I just did a simple initial netstat, where for eth0 : TX-OK = 485 after 1 ping message is send, again I see in netstat TX-OK = 488 So, I just want to know ...
0
votes
1answer
1k views

restart counter in netstat

I am using Ubuntu. I need to count the number of packet received in a specific interface. I found this can be done using netstat. However, I need to count starting from t=zero until a specific time I ...
1
vote
1answer
756 views

netstat -e: high discards and errors

I think my network is congested because of the relatively large discards and errors data. They should be zero or at least close to that. Here is the output of netstat -e on my computer: Interface ...
1
vote
1answer
304 views

What's the difference between Send-Q and S-BCNT in FreeBSD netstat -anx?

What's the exact meaning of Send Buffer byte count in the extended netstat statistics, and why is it always bigger than Send-Q? In other words, what's counted against the S-BCNT that's not counted ...
1
vote
3answers
820 views

Linux : restricting outgoing on an application basis

I typed : netstat -atlpvn and noticed that applications like gedit and python had foreign addresses outside the network (the network being a single computer connected to the internet). Is there ...
1
vote
4answers
2k views

Netstat: How to know if it's Human or Bot/Spider/DDOS

I'm using the following command to check how many connections I have from a single ip netstat -anp |grep ':80' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n If it's DDOS attack(500+ ...
1
vote
2answers
5k views

Understanding the netstat command output

I used netstat command recently, and the output is below. netstat -a proto local address foreign address state tcp 127.0.0.1:1107 avinash-pc:0 listening tcp ...
1
vote
1answer
238 views

Process killing trouble

I am trying to program a server software which involves a lot of testing on java / scala platform. Whenever i compile and execute the code. It starts listening on port 80. Sometimes i need to ...
1
vote
2answers
732 views

netstat doesn't display full remote ip address, no ip address for ssl, port 443

We're running a Apache webserver on Arch Linux (build from May '10) and while monitoring connections with netstat we're seeing some odd connections on port 443 that don't report an IP address; is this ...
2
votes
2answers
5k views

analyse TCP performance by interpreting “netstat -s”

I have executed netstat -s on my dedicated server running debian. I'd like to interprete the results because I'm experiencing connectivity problems with TCP. I don't know how to read these results. ...
1
vote
1answer
1k views

FreeBSD netstat -di, Idrop vs Drop and drop count from NIC or kernel?

On FreeBSD what's the difference between Drop and Idrop in the netstat output? $ netstat -di Name Mtu Network Address Ipkts Ierrs Idrop Opkts Oerrs Coll Drop bge0* 1500 ...
7
votes
3answers
9k views

How to kill a TCP connection using tcpkill utility

I'm trying to kill an ESTABLISHED TCP connection using tcpkill. The connection is an open HTTPS connection. It appears on netstat as: tcp 0 0 X.X.X.X:55601 X.X.X.X:https ...
3
votes
2answers
3k views

netstat and ip_conntrack connection count differ by order of magnitude. Why?

in /proc/net/ip_conntrack I have: established 3076 time_wait 4346 total 7468 and in netstat I have: established 1051 time_wait 73 total 1165 Why is that? Where are other connections? How to ...
9
votes
6answers
9k views

netstat shows a listening port with no pid but lsof does not

This question is similar to Network port open, but no process attached? I've tried everything from there, reviewed the logs, etc... and can't find anything. My netstat shows a TCP listening port and ...
1
vote
2answers
5k views

Can ping an ip but does not show up in netstat?

I was wondering if someone would be able to help me with a head scratcher. We have a device that has communicated with our server but is not sending back any data. I am able to ping the IP address ...
0
votes
1answer
546 views

When Does the Linux & Windows' Samba Port Connection Close?

After connecting to a samba share, then disconnecting, netstat still shows that the ports are ESTABLISHED, even when the clients are on SUSPEND, HIBERNATE, or have SHUTDOWN. Looking over the samba ...
7
votes
3answers
6k views

TIME_WAIT connections not being cleaned up after timeout period expires

I am stress testing one of my servers by hitting it with a constant stream of new network connections, the tcp_fin_timeout is set to 60, so if I send a constant stream of something like 100 requests ...
0
votes
2answers
384 views

Problem with too many local connections

I have a problem with my server (VPS). It's veeery slow. Checking the connections with netstat, there are a lot of internal connections. I don't understand why! It's normal all this connections? # ...
0
votes
1answer
818 views

FileMaker Server not listening on Port 2399 for ODBC/JDBC

I am trying to create a ODBC connection from an OSX machine to a Filemaker server 10 using a DataDirect SeQuel Link 5.5 JDBC drive. I have ODBC/JDBC enabled on the server and I followed all of the ...
0
votes
2answers
166 views

WinServer 2003: Cant find process holding onto ports

We have a couple of production WCF services failing to start because their ports are apparently in use by another process. I have done a netstat -ano and found the PID's that are using these ports, ...
4
votes
2answers
6k views

lots of packets pruned and packets collapsed because of socket buffer low/overrun

i've set up a test machine (debian squeeze 2.6.32 on a linode 2048 machine) that interact with an api that returns large chunks of json. It calls the API 3000/minutes asynchronously, the api is ...
0
votes
1answer
2k views

Is this normal? Multiple httpd process

I'm testing a new Server. This isnt really a peak time for my server (2pm), but still its running a bit slow, I was checking the ESTABLISHED connections using the following command: # netstat -ntu | ...
3
votes
2answers
2k views

What does each field of netstat -ano mean?

tcp 0 0 219.155.32.195:8888 221.137.227.51:5943 TIME_WAIT timewait (58.45/0/0) tcp 0 0 219.155.32.195:8888 221.137.227.51:5936 TIME_WAIT timewait ...
1
vote
0answers
572 views

High count packets rejects in established connections because of timestamp

I am trying to set up a Wowza media server using a Dell R710 with 24GB memory and a 10Gbit connection and all the calculations say it should be able to handle around 20k connections however when I get ...
2
votes
2answers
1k views

Apache many httpd process by my own server IP? eating all my Ram

Well i just bought a new dedicated server, I have no Linux experience, but i'm trying to learn. I have been testing the server for a few days. I improve the httpd.conf my.cnf for better performance, ...
2
votes
2answers
3k views

(node) Hit max file limit. Increase “ulimit -n”

In Ubuntu 9 I am receiving a message on my server that says: (node) Hit max file limit. Increase "ulimit -n" However, typing commands in the terminal reveals the following: $ ulimit ...
0
votes
2answers
1k views

How to speed up a server using netstat & httpd.conf?

I'm using netstat commands to help optimize my httpd.conf correctly. Here are the results: netstat -an | grep -c :80 579 netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq ...
0
votes
1answer
783 views

How to monitor real time sendq and recvq sizes

netstat -an will give the recvq and sendq on a particular connection. When I have an application (in this case a dumb echo server) listening on a port and I put the load on and run netstat in a loop, ...