netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

0
votes
1answer
1k views

How to check if sockets are sending/receiving data on linux?

I often have to debug processes which involve a server client tcp connection. I'd like to check, during times where a client might seem stuck, whether the server is sending it data or not. I can use: ...
0
votes
1answer
490 views

Find IP addresses with most connections on system

I am currently experiencing some attacks on my OpenVZ server (CentOS 6.3 64bit), which is saturating the public ethernet interface (currently accessing SSH via the private interface). Is it possible ...
3
votes
1answer
101 views

What is a good way to determine a server's connection usage?

Trying to figure out where my system's connections are being used (i.e. how many connections belong to what processes - could even be filtered by some expression through grep, if it applies). The ...
0
votes
1answer
439 views

No response from IIS

My problem is that the Default Web Site can be opened from the server machine (localhost), but cannot be opened from a test machine (which is in the same LAN). Netstat says that IIS 7.5 is listening ...
0
votes
1answer
298 views

How can I find the cause of an unknown connection showing in iftop?

I have connections like this showing frequently in iftop: 12.15.127.75.host.nwnx.net => 121.61.153.172 480b 160b 40b I have no idea ...
2
votes
1answer
793 views

Can't Access CouchDB Remotely

Please keep in mind that I have this installed on an Amazon EC2 instance running the latest version of Ubuntu Server. I have changed the bind_address to 0.0.0.0. netstat -an | grep 5984 yields the ...
1
vote
1answer
297 views

How to see IPs of user using the most SYN_RECV, TIME_WAIT, etc?

Does anyone recommend (or have a netstat script) that will print the IP sending the most of X (where X is FIN_WAIT, SYN_RECV, etc.). Like, I have this netstat -nat | awk '{print $6}' | sort | uniq -...
0
votes
1answer
950 views

Apache creates lots of processes in CLOSE_WAIT state and than crashes

I have a web server (centos) with Apache 2.4.3 and in peak times Apache becomes unresponsive until I restart it. Before it happens there is suddenly spike of httpd proccesses count and it seems that ...
0
votes
1answer
597 views

What does this netstat output mean?

I run a moderately active website on a dedicated server. In the course of protecting against (D)DOS attacks, I ran netstat to get a count of active connections. This produced a rather unusual result ...
0
votes
1answer
310 views

Apache SSL not accepting outside traffic

Running Apache 2 on Ubuntu 11 in Amazon EC2. Tried to add a new SSL VirtualHost by doing the following: Added "Listen 443" to ports.conf. Added new VirtualHost in my enabled site and "SSLEngine on". ...
0
votes
1answer
698 views

Hundreds of local loopback TIME_WAIT connections on port 7080, Plesk [duplicate]

If I run netstat -tnep I see about two dozen or so regulra connections, then hundreds and hundreds of local loopback conenctions to port 7080. I assume this is something to do with Plesk, but could ...
2
votes
2answers
438 views

When using netstat on a listening port what is the difference between localhost:6666 and [::]:6666 in 'Local Address' field

Using ubuntu 11.04, I run netstat -nplt the results for local address may be localhost:6666 or [::]:6666 What is the difference? I believe that the [::]: binds the service at ...
-1
votes
2answers
35k views

Avoid TIME_WAIT connections [duplicate]

When I use netstat command it shows.. tcp 0 0 localhost:18056 localhost:mysql TIME_WAIT tcp 0 0 localhost:16683 localhost:mysql ...
1
vote
2answers
926 views

Established connection to a blocked port, what does it mean?

I'm pretty new to system administration, and I've been trying to get more familiar with tools like netsat. If I run netstat -n on my server, I see this line: tcp 0 0 xxx.xxx.xxx.xxx:44573 ...
1
vote
2answers
242 views

Averaging dstat output

I need to average upload and download speed using dstat -n. How can I add all the received and sent datas that appear after dstat -n, so that I can add them and find average upload and download ...
0
votes
4answers
197 views

How to I start with a remote IP address connected to my computer to the process that has opened the connection?

If I type "netstat", I can see a list of IP addresses that my PC is connected to. If I start with an IP address, how do I find the process that has opened the connection to said IP address?
1
vote
1answer
174 views

Confusing traffic in netstat, nothing in logs

Just had a confusing couple of minutes! I was monitoring a screen (the gnu screen) running "netstat -a" and I noticed that there was one connection connected to http (port 80), fine. But when I ...
0
votes
1answer
130 views

Port scanning from localhost

I see lot of tcp connections on different ports on my server with 'TIME_WAIT' status. Just simple port scan, but i cant see ip address of this bastard because connections is going from my nginx. Can ...
0
votes
2answers
1k views

Why does netstat show Tomcat process listen to multiple ports?

The netstat output with the tomcat process(pid: 28899) is as followed: Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:...
1
vote
2answers
3k views

FreeBSD Listen Queue Overflows - can't increase max queue size

I have a decently high trafficked FreeBSD Nginx server, and I'm starting to get a large number of listen queue overflows: [root@svr ~]# netstat -sp tcp | fgrep listen 80361931 listen queue overflows [...
0
votes
1answer
336 views

Netstat shows Time_Wait in MySQL Master to master replication

During my master to master replication, I got a problem on telnet. After fixing it also my replication on both side doesn't work. Master 2 replicates all the database of Master 1 but Master 1 is ...
8
votes
2answers
1k views

Where are my TIME_WAITs on Mac OS X?

No TIME_WAITs on Mac OS X Normally, when a TCP connection is closed, the socket on the side where close() is called first is left in the TIME_WAIT state. When one of the peers is a Mac OS X (Lion) ...
0
votes
5answers
14k views

netstat shows many times deploy.akamaitechnologies.com connected to my server

Many times, after running netstat on my server, I find one of IP addresses belonging to deploy.akamaitechnologies.com connected to my server, do someone has an idea on what is happening on my server ? ...
0
votes
1answer
283 views

netstat outputs same local adress for 2 different connections

Trying to understand how to read netstat output. In my browser I opened site1.com On my server netstat -A inet -p -e outputs the following: tcp 0 0 site1.com:www foreign-adress:...
3
votes
2answers
4k views

linux : netstat listeting queue length

Is there a way to view queue length on listening socket under linux, the same way as netstat -L outputs for freebsd? I.e. you can see X/Y/Z in netstat -L output, but netstat under linux doesn't ...
0
votes
1answer
606 views

Mountain Lion, How can I release port?

$ netstat -ltanp tcp | grep 8000 | grep LISTEN tcp4 0 0 *.8000 *.* LISTEN I want to release this port When I do $ lsof -i:8000 I get nothing I ...
2
votes
2answers
185 views

What does “::” denote in windows netstat results?

I'm trying to understand on which interfaces a TCP port is open Using windows netstat command I get result like : TCP [::]:10000 MyMachineName:0 LISTENING What does ...
1
vote
1answer
910 views

How to remove the hint in the terminal?

As a normal user , when I run some command like ps\netstat, the terminal hint me: (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see ...
1
vote
0answers
370 views

how to get send-q and receive-q on windows server

in linux, is very easy to troubleshoot a remote connection problem because netstat show the send-q and recv-q. This is very useful because we can know if the remote peer is reading the server send ...
3
votes
2answers
4k views

How to determine which TCP/UDP ports are being opened by a given process (linux)?

I know how to do the opposite (find out what process has a given port open) using lsof or netstat, but extensive research on Google hasn't helped me solve the reverse problem. I know I could use "...
1
vote
3answers
1k views

Find whats using all my servers bandwidth

TLDR: how can I dig deeper into my Mac mini OSX server to determine what processes are consuming so much bandwidth, or where all the inbound traffic is coming from? Resource caching is on, all ...
3
votes
1answer
349 views

AIX: is it somehow possible to get a ForeignAddress/PID pair like we are able to get in Linux with netstat?

In Linux (RHEL), we are able to get a ForeignAddress/PID pair with "netstat -ntp" command: [root@rhel ~]# netstat -ntp Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address ...
1
vote
1answer
1k views

Debian iptables, netstate. DDOS? [duplicate]

My server has been timing out and crashing lately. I ran this command: netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n Check the picture for result. ...
2
votes
2answers
1k views

iftop Shows Lots of Mysterious Connections - Not Showing in netstat

I've just stopped all pretty much all services except sshd on my server (Ubuntu Server 10.04), and when I run iftop I get output that looks like this: 12.5Kb 25.0Kb ...
0
votes
1answer
8k views

DDOS Attack detection with netstat [duplicate]

I have a server, today load of my server over 20, i was found a command that detect alive connection to server for DDOS detection and reject IP. netstat -anp | grep 'tcp\|udp' | awk '{print $5}' | ...
1
vote
2answers
325 views

Difference between two netstat results for Apache

We are running RedHat Linux on two front end webservers both running Apache HTTP Server. I have done a diff on both httpd.conf files and there are no differences but the server hostnames. We have ...
3
votes
2answers
12k views

Netstat continuous refresh (watch changes the output)

I am using this simple command to monitor connections (to deal with some recent DOS attacks) on my Debian server: netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n How do I ...
0
votes
1answer
176 views

ss utility does't work properly

I've learned that ss, which is base on netlink, is much faster than netstat when amount of sockets is large. And the secret is here. But when I tested on my suse linux minutes ago, the result ...
4
votes
2answers
1k views

How to know which process was using a port after it enters TIME_WAIT state?

On Linux, is there a way to figure out what process was using a port, before it went into TIME_WAIT state. When I use netstat -tnp I just see two end points, but no process information. Proto Recv-Q ...
-1
votes
0answers
55 views

netstat showing too many connections (Established) [duplicate]

Possible Duplicate: Too Many ESTABLISHED connection from a single IP address in Apache netstat -ntp |grep 80 shows too many ESTABLISHED connection from single IP address. Around 300 of them ...
1
vote
3answers
3k views

Too Many ESTABLISHED connection from a single IP address in Apache

netstat -ntp |grep 80 shows too many ESTABLISHED connection from single IP address. Around 300 of them and it is not an attack and user is using a 2G connection to access Apache. This is the case ...
1
vote
1answer
327 views

apache2 won't start yet gives no error [closed]

I'm running apache2 on Debian testing on the Asus Slider sl101 tablet chrooted running on the android kernel. root@hoshi:/# root@hoshi:/# /etc/init.d/apache2 restart Restarting web server: apache2. ...
2
votes
3answers
3k views

Unexplicated ssh connection from localhost through sshd to random localhost's port

I've tried to find out why I had some strange connections on my secure log file. Something like this : Apr 23 11:35:43 li192-61 sshd[11651]: Did not receive identification string from 127.0.0.1 Apr ...
0
votes
2answers
2k views

Why is the port listed only in the specific format of netstat?

I have Tomcat and I am trying to bind to 2 specific ports (using custom connectors). E.g. port A and port B. Problem: When I do netstat -a |grep A I do NOT see the port listed. If I do netstat -antp I ...
0
votes
1answer
311 views

Very strange localhost connections on linux workstation. Need help identifiying the source

The following is the output of netstat on a Ubuntu machine. Can someone help decrypt the output? I am especially curious what the ::1:43213 connection is. Also, why are there so many connections ...
0
votes
1answer
2k views

How to utilise netstat information

We have an application named "Seamer" installed on 2008R2 machine named "R2DUO" which has IP address set as 192.61.247.37 in host file and 172.26.127.40 is IP address of Ethernet card .We have two ...
0
votes
1answer
463 views

fast opening and closing connection with a specific port

We have a Main application named "Trevor" installed in 2008R2 machine named "TEAMER12" which is slow now. One more application named "TVS" also running in and found there were many connections per ...
6
votes
1answer
6k views

Port 80 being used by Microsoft-HTTPAPI/2.0

It's been quite a few days that port is being used by some strange process which i don't know Initially i thought it's related to SQL Server. I tried stopping all the services which starts from SQL :)....
1
vote
1answer
296 views

How to find malicious IPs?

Cacti shows irregular and pretty steady high bandwidth to my server (40x the normal) so I guess the server is udnder some sort of DDoS attack. The incoming bandwidth has not paralyzed my server, but ...
1
vote
1answer
552 views

nginx serving .php as static files

ok, again apparently a totally ridiculous problem which I just can't seem to figure out. nginx keeps serving my .php files as static files. I've installed nginx via the repositories on ubuntu. I've ...