netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

4
votes
2answers
905 views

How to know which process was using a port after it enters TIME_WAIT state?

On Linux, is there a way to figure out what process was using a port, before it went into TIME_WAIT state. When I use netstat -tnp I just see two end points, but no process information. Proto Recv-Q ...
-1
votes
0answers
52 views

netstat showing too many connections (Established) [duplicate]

Possible Duplicate: Too Many ESTABLISHED connection from a single IP address in Apache netstat -ntp |grep 80 shows too many ESTABLISHED connection from single IP address. Around 300 of ...
1
vote
3answers
2k views

Too Many ESTABLISHED connection from a single IP address in Apache

netstat -ntp |grep 80 shows too many ESTABLISHED connection from single IP address. Around 300 of them and it is not an attack and user is using a 2G connection to access Apache. This is the case ...
1
vote
1answer
274 views

apache2 won't start yet gives no error [closed]

I'm running apache2 on Debian testing on the Asus Slider sl101 tablet chrooted running on the android kernel. root@hoshi:/# root@hoshi:/# /etc/init.d/apache2 restart Restarting web server: apache2. ...
1
vote
3answers
2k views

Unexplicated ssh connection from localhost through sshd to random localhost's port

I've tried to find out why I had some strange connections on my secure log file. Something like this : Apr 23 11:35:43 li192-61 sshd[11651]: Did not receive identification string from 127.0.0.1 Apr ...
0
votes
2answers
1k views

Why is the port listed only in the specific format of netstat?

I have Tomcat and I am trying to bind to 2 specific ports (using custom connectors). E.g. port A and port B. Problem: When I do netstat -a |grep A I do NOT see the port listed. If I do netstat -antp I ...
0
votes
1answer
248 views

Very strange localhost connections on linux workstation. Need help identifiying the source

The following is the output of netstat on a Ubuntu machine. Can someone help decrypt the output? I am especially curious what the ::1:43213 connection is. Also, why are there so many connections ...
0
votes
1answer
1k views

How to utilise netstat information

We have an application named "Seamer" installed on 2008R2 machine named "R2DUO" which has IP address set as 192.61.247.37 in host file and 172.26.127.40 is IP address of Ethernet card .We have two ...
0
votes
1answer
314 views

fast opening and closing connection with a specific port

We have a Main application named "Trevor" installed in 2008R2 machine named "TEAMER12" which is slow now. One more application named "TVS" also running in and found there were many connections per ...
4
votes
1answer
4k views

Port 80 being used by Microsoft-HTTPAPI/2.0

It's been quite a few days that port is being used by some strange process which i don't know Initially i thought it's related to SQL Server. I tried stopping all the services which starts from SQL ...
1
vote
1answer
265 views

How to find malicious IPs?

Cacti shows irregular and pretty steady high bandwidth to my server (40x the normal) so I guess the server is udnder some sort of DDoS attack. The incoming bandwidth has not paralyzed my server, but ...
1
vote
1answer
496 views

nginx serving .php as static files

ok, again apparently a totally ridiculous problem which I just can't seem to figure out. nginx keeps serving my .php files as static files. I've installed nginx via the repositories on ubuntu. I've ...
3
votes
3answers
707 views

python reports socket in use, netstat and others claim its not

We have a strange socket issue with a RHES3 box: Python 2.4.1 (#1, Jul 5 2005, 19:17:11) [GCC 3.2.3 20030502 (Red Hat Linux 3.2.3-52)] Type "help", "copyright", "credits" or "license" for more ...
3
votes
1answer
567 views

Interpreting Netstat output

I have a LAMP stack running Fedora 12 and I am run the following instruction through the command line on the server: netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | ...
1
vote
2answers
520 views

How to measure bandwidth within the last 15 minutes?

I would like to log my bandwidth into a database and find out when my windows server 2003 is being used the most. I want to feed the database with the bandwidth passed from the last feed (let's say ...
1
vote
1answer
944 views

How to reset netstat -e counters

I would like to reset netstat -e counters. How can I do it? Renewing the network interface may reset these counters, but it is NOT an option - the networking must not be interrupted. My OS is ...
0
votes
1answer
108 views

size of packet icmp with netstat TX

I am confused with the size of packet icmp. I just did a simple initial netstat, where for eth0 : TX-OK = 485 after 1 ping message is send, again I see in netstat TX-OK = 488 So, I just want to know ...
0
votes
1answer
1k views

restart counter in netstat

I am using Ubuntu. I need to count the number of packet received in a specific interface. I found this can be done using netstat. However, I need to count starting from t=zero until a specific time I ...
1
vote
1answer
681 views

netstat -e: high discards and errors

I think my network is congested because of the relatively large discards and errors data. They should be zero or at least close to that. Here is the output of netstat -e on my computer: Interface ...
1
vote
1answer
285 views

What's the difference between Send-Q and S-BCNT in FreeBSD netstat -anx?

What's the exact meaning of Send Buffer byte count in the extended netstat statistics, and why is it always bigger than Send-Q? In other words, what's counted against the S-BCNT that's not counted ...
1
vote
3answers
752 views

Linux : restricting outgoing on an application basis

I typed : netstat -atlpvn and noticed that applications like gedit and python had foreign addresses outside the network (the network being a single computer connected to the internet). Is there ...
1
vote
4answers
2k views

Netstat: How to know if it's Human or Bot/Spider/DDOS

I'm using the following command to check how many connections I have from a single ip netstat -anp |grep ':80' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n If it's DDOS attack(500+ ...
1
vote
2answers
4k views

Understanding the netstat command output

I used netstat command recently, and the output is below. netstat -a proto local address foreign address state tcp 127.0.0.1:1107 avinash-pc:0 listening tcp ...
1
vote
1answer
226 views

Process killing trouble

I am trying to program a server software which involves a lot of testing on java / scala platform. Whenever i compile and execute the code. It starts listening on port 80. Sometimes i need to ...
1
vote
2answers
688 views

netstat doesn't display full remote ip address, no ip address for ssl, port 443

We're running a Apache webserver on Arch Linux (build from May '10) and while monitoring connections with netstat we're seeing some odd connections on port 443 that don't report an IP address; is this ...
2
votes
2answers
5k views

analyse TCP performance by interpreting “netstat -s”

I have executed netstat -s on my dedicated server running debian. I'd like to interprete the results because I'm experiencing connectivity problems with TCP. I don't know how to read these results. ...
1
vote
1answer
964 views

FreeBSD netstat -di, Idrop vs Drop and drop count from NIC or kernel?

On FreeBSD what's the difference between Drop and Idrop in the netstat output? $ netstat -di Name Mtu Network Address Ipkts Ierrs Idrop Opkts Oerrs Coll Drop bge0* 1500 ...
7
votes
3answers
8k views

How to kill a TCP connection using tcpkill utility

I'm trying to kill an ESTABLISHED TCP connection using tcpkill. The connection is an open HTTPS connection. It appears on netstat as: tcp 0 0 X.X.X.X:55601 X.X.X.X:https ...
3
votes
2answers
3k views

netstat and ip_conntrack connection count differ by order of magnitude. Why?

in /proc/net/ip_conntrack I have: established 3076 time_wait 4346 total 7468 and in netstat I have: established 1051 time_wait 73 total 1165 Why is that? Where are other connections? How to ...
9
votes
6answers
8k views

netstat shows a listening port with no pid but lsof does not

This question is similar to Network port open, but no process attached? I've tried everything from there, reviewed the logs, etc... and can't find anything. My netstat shows a TCP listening port and ...
1
vote
2answers
5k views

Can ping an ip but does not show up in netstat?

I was wondering if someone would be able to help me with a head scratcher. We have a device that has communicated with our server but is not sending back any data. I am able to ping the IP address ...
0
votes
1answer
525 views

When Does the Linux & Windows' Samba Port Connection Close?

After connecting to a samba share, then disconnecting, netstat still shows that the ports are ESTABLISHED, even when the clients are on SUSPEND, HIBERNATE, or have SHUTDOWN. Looking over the samba ...
7
votes
3answers
6k views

TIME_WAIT connections not being cleaned up after timeout period expires

I am stress testing one of my servers by hitting it with a constant stream of new network connections, the tcp_fin_timeout is set to 60, so if I send a constant stream of something like 100 requests ...
0
votes
2answers
354 views

Problem with too many local connections

I have a problem with my server (VPS). It's veeery slow. Checking the connections with netstat, there are a lot of internal connections. I don't understand why! It's normal all this connections? # ...
0
votes
1answer
761 views

FileMaker Server not listening on Port 2399 for ODBC/JDBC

I am trying to create a ODBC connection from an OSX machine to a Filemaker server 10 using a DataDirect SeQuel Link 5.5 JDBC drive. I have ODBC/JDBC enabled on the server and I followed all of the ...
0
votes
2answers
165 views

WinServer 2003: Cant find process holding onto ports

We have a couple of production WCF services failing to start because their ports are apparently in use by another process. I have done a netstat -ano and found the PID's that are using these ports, ...
4
votes
2answers
6k views

lots of packets pruned and packets collapsed because of socket buffer low/overrun

i've set up a test machine (debian squeeze 2.6.32 on a linode 2048 machine) that interact with an api that returns large chunks of json. It calls the API 3000/minutes asynchronously, the api is ...
0
votes
1answer
2k views

Is this normal? Multiple httpd process

I'm testing a new Server. This isnt really a peak time for my server (2pm), but still its running a bit slow, I was checking the ESTABLISHED connections using the following command: # netstat -ntu | ...
3
votes
2answers
2k views

What does each field of netstat -ano mean?

tcp 0 0 219.155.32.195:8888 221.137.227.51:5943 TIME_WAIT timewait (58.45/0/0) tcp 0 0 219.155.32.195:8888 221.137.227.51:5936 TIME_WAIT timewait ...
1
vote
0answers
537 views

High count packets rejects in established connections because of timestamp

I am trying to set up a Wowza media server using a Dell R710 with 24GB memory and a 10Gbit connection and all the calculations say it should be able to handle around 20k connections however when I get ...
2
votes
2answers
1k views

Apache many httpd process by my own server IP? eating all my Ram

Well i just bought a new dedicated server, I have no Linux experience, but i'm trying to learn. I have been testing the server for a few days. I improve the httpd.conf my.cnf for better performance, ...
2
votes
2answers
2k views

(node) Hit max file limit. Increase “ulimit -n”

In Ubuntu 9 I am receiving a message on my server that says: (node) Hit max file limit. Increase "ulimit -n" However, typing commands in the terminal reveals the following: $ ulimit ...
0
votes
2answers
1k views

How to speed up a server using netstat & httpd.conf?

I'm using netstat commands to help optimize my httpd.conf correctly. Here are the results: netstat -an | grep -c :80 579 netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq ...
0
votes
1answer
723 views

How to monitor real time sendq and recvq sizes

netstat -an will give the recvq and sendq on a particular connection. When I have an application (in this case a dumb echo server) listening on a port and I put the load on and run netstat in a loop, ...
2
votes
3answers
687 views

netstat issue: cannot pipe output from 'netstat -c' to an nfs mount

Short version: Netstat works fine except when I redirect output to a file in NFS. doesn't work: netstat -c > /nfs/mount/file works: netstat > /nfs/mount/file works: netstat -c works: ...
2
votes
0answers
578 views

Netstat Send-Q High

Am using Ubuntu Server 10.10 and when i do netstat -tuna i get the many connections with Send-Q very high, 23K, 50K, 100K. This users report that they have latency problems when connecting to the ...
18
votes
5answers
17k views

How to find other end of unix socket connection?

I have a process (dbus-daemon) which has many open connection over UNIX sockets. One of these connections is fd #36: =$ ps uw -p 23284 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME ...
0
votes
2answers
821 views

Why can't I access my Linux FTP (vsftpd) server?

I've just installed vsftpd, and started the service. The service is running, and my netstat dump shows it (See below). I've also enabled anonymous access for good measure. However, when I try to ...
0
votes
1answer
1k views

Port 8080 not visible while doing netstat?

While trying to run Tomcat on my Windows 2003 OS, I am noticing that the server is not running but at the same time it is not throwing any exceptions on the console. My first hunch was that the server ...
1
vote
2answers
414 views

Linux: How to display all sockets opened for a particular interface?

How can I display all sockets opened for a particular interface?