netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

1
vote
1answer
2k views

Ierrs on Network Interface - Pfsense/Freebsd

We're using PfSense as an internal router/firewall (no connection to WAN). Using the Web-GUI, under Status ---> Interfaces, there's one particular interface where I have some errors: In/out errors ...
1
vote
2answers
36 views

See stats of data in and out of each connection to a port

I have an application listening to a port. The clients connect to it using http connection. At any given time I see around 3000 connections established. I assume not all these connections are in use ...
1
vote
0answers
68 views

Why is SQL Server using all ephemeral ports connecting to itself and causing TIME_WAITs?

I've got an AWS server with Windows 2008 R2, SQL Server 2012, and Tomcat 7. When I run netstat -ano the screen is flooded with TIME_WAIT. I posted the output in a Gist. When I run CurrPorts, filter ...
1
vote
0answers
123 views

TCP High Send-q coupled with FIN_WAIT1 status

I'm having a problem with one of my webservers, which is taking minutes to completely render a web page. I had a look at the TCP connection and noticed that I have a very high value in the send-q ...
1
vote
1answer
209 views

Port suddenly closed. How to re-open?

I've written a software module in PHP that manages the saving of data in different data stores (MySQL, ElasticSearch and Redis). To test the module, I've created several test plans in Apache JMeter, ...
1
vote
0answers
41 views

How to check a given connection has been offloaded to network card

From what I read, some part of the tcp protocol operation can be offloaded from kernel to network card driver thanks to TOE (or GSO, LSO, LRO..). My objective is too find if a given socket has some ...
1
vote
0answers
77 views

iptables traffic after forwarding

I have 2 servers Server A and Server B ServerA = 1.1.1.1 ServerB = 2.2.2.2 I am using ip-tables to send all traffic on port 80 to Server B on Server (A) 1.1.1.1 i have done iptables -t nat -A ...
1
vote
1answer
148 views

Limit Number of TCP connections in Linux Server, to avoid attack

I want to limit the number of TCP connections in Linux server, I have used the following command. iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 25 --connlimit-mask 32 ...
1
vote
0answers
493 views

What does “connections reset due to unexpected data” in netstat -s mean

I'm running a memcached server under heavy load from multiple web servers. While investigating some odd app level behaviour, we spotted that netstat -s on the memcached box was showing a lot of ...
1
vote
1answer
2k views

UDP port appears to be in use but is not shown in netstat or TCPView

I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen ...
1
vote
1answer
156 views

Confusing traffic in netstat, nothing in logs

Just had a confusing couple of minutes! I was monitoring a screen (the gnu screen) running "netstat -a" and I noticed that there was one connection connected to http (port 80), fine. But when I ...
1
vote
0answers
285 views

how to get send-q and receive-q on windows server

in linux, is very easy to troubleshoot a remote connection problem because netstat show the send-q and recv-q. This is very useful because we can know if the remote peer is reading the server send ...
1
vote
1answer
300 views

apache2 won't start yet gives no error [closed]

I'm running apache2 on Debian testing on the Asus Slider sl101 tablet chrooted running on the android kernel. root@hoshi:/# root@hoshi:/# /etc/init.d/apache2 restart Restarting web server: apache2. ...
1
vote
1answer
524 views

nginx serving .php as static files

ok, again apparently a totally ridiculous problem which I just can't seem to figure out. nginx keeps serving my .php files as static files. I've installed nginx via the repositories on ubuntu. I've ...
1
vote
1answer
757 views

netstat -e: high discards and errors

I think my network is congested because of the relatively large discards and errors data. They should be zero or at least close to that. Here is the output of netstat -e on my computer: Interface ...
1
vote
0answers
574 views

High count packets rejects in established connections because of timestamp

I am trying to set up a Wowza media server using a Dell R710 with 24GB memory and a 10Gbit connection and all the calculations say it should be able to handle around 20k connections however when I get ...
1
vote
1answer
190 views

Netstat flags on OS/2

On an OS/2 box, what do the flags UGDP mean in the output of netstat -r. Google seems to point to them meaning Up, Gateway (i.e. an indirect root), and Dynamic (learned from a redirect), but that ...
1
vote
1answer
662 views

Lots of TIME_WAIT from same IP address

I've seen a lot of questions with people concerned about lots of TIME_WAITs in netstat. I'm having a similar problem but all the TIME_WAITs are coming from the same IP address. I get over 200 of the ...
1
vote
2answers
433 views

Linux: How to display all sockets opened for a particular interface?

How can I display all sockets opened for a particular interface?
0
votes
1answer
183 views

Netstat - Thunderbird and others work on strange ports

I'm getting this: $ sudo netstat -alpv tcp 0 0 comp.local:35409 ey-in-f16.1e100.n:imaps ESTABLISHED 2782/thunderbird-bi tcp 0 0 comp.local:52950 ...
0
votes
2answers
1k views

Why is the port listed only in the specific format of netstat?

I have Tomcat and I am trying to bind to 2 specific ports (using custom connectors). E.g. port A and port B. Problem: When I do netstat -a |grep A I do NOT see the port listed. If I do netstat -antp I ...
0
votes
3answers
380 views

Is this hacking attempt?

on command netstat -na, between others, i'm getting next line: tcp 0 0 XXX.XXX.XXX.XXX:48746 YYY.YYY.YYY.YYY:80 TIME_WAIT is this some kind of hacking attempt? can you ...
0
votes
1answer
120 views

Port scanning from localhost

I see lot of tcp connections on different ports on my server with 'TIME_WAIT' status. Just simple port scan, but i cant see ip address of this bastard because connections is going from my nginx. Can ...
0
votes
1answer
5k views

DDOS Attack detection with netstat [duplicate]

I have a server, today load of my server over 20, i was found a command that detect alive connection to server for DDOS detection and reject IP. netstat -anp | grep 'tcp\|udp' | awk '{print $5}' | ...
0
votes
3answers
1k views

Port listed as close-combat in netstat

Have just run netstat -A on my SQL Server and seen an established connection from one of our workstations on bmcw000340.domain:close-combat. My google-fu is failing me and I can't find out what ...
0
votes
1answer
279 views

What causes “SYN to LISTEN sockets dropped”?

A quite busy proxy server has lots of "SYNs to LISTEN sockets dropped". I learned one cause could be a too small backlog size. But in that case the "times the listen queue of a socket overflowed" ...
0
votes
2answers
177 views

netstat brought up strange ip

I just ran netstat -vatn and found there was a connection ESTABLISHED on :22 from my ip and another unknown ip. Moments later I ran it again and found the connection was gone. I have a default ...
0
votes
1answer
516 views

What does this netstat output mean?

I run a moderately active website on a dedicated server. In the course of protecting against (D)DOS attacks, I ran netstat to get a count of active connections. This produced a rather unusual result ...
0
votes
2answers
3k views

netstat reports PID that doesn't exist - wtf and how do I close it?

I have an app that listens on port 7001, which sometimes crashes but leaves the port open. netstat reports a PID that doesn't exist. How is that possible? How can I force the port to close without ...
0
votes
3answers
2k views

Windows server 2008 & SQL - many connections in TIME_WAIT

When I run netstat, I get this: TCP xxxx:65524 65.55.11.162:80 TIME_WAIT 0 There are 13941 of such lines in netstat at this point. Server is running Windows 2008 & SQL ...
0
votes
1answer
348 views

Find IP addresses with most connections on system

I am currently experiencing some attacks on my OpenVZ server (CentOS 6.3 64bit), which is saturating the public ethernet interface (currently accessing SSH via the private interface). Is it possible ...
0
votes
1answer
257 views

Very strange localhost connections on linux workstation. Need help identifiying the source

The following is the output of netstat on a Ubuntu machine. Can someone help decrypt the output? I am especially curious what the ::1:43213 connection is. Also, why are there so many connections ...
0
votes
1answer
794 views

100 TIME_WAIT Connections to 1433 (sqlserver) port from one remote IP

What to do? Block that IP in firewall? What is this?
0
votes
3answers
107 views

apache is up but does not read requests

This usually happens a few minutes after restarting apache: httpd daemons are up, but are not reading the requests from the sockets. The web clients just wait forever on the connection. When I run ...
0
votes
2answers
2k views

The PID and name of the program to which socket belongs

Using 'netstat -tulp' on my server box running under CentOS I have discovered strange listening ports 33363 (TCP) and 35661 (UDP). The thing is that 'PID/Program name' field for these ports contains ...
0
votes
1answer
53 views

SSH Tunnel not working

I have a number of SSH tunnels set up between our company's server (hosts website) and our customer's servers (hosts database). For all sites but one the connection is relatively stable however one ...
0
votes
1answer
700 views

Nginx not running with no error message (ubuntu 14.04 lts)

I am trying to start my nginx server. When I type "$> /etc/init.d/nginx start", I have a message appearing "Starting nginx: Ok", and then nothing happens. When I type "sudo lsof -nP -i | grep ...
0
votes
1answer
1k views

Random TCP Resets

We got randomly TCP "reset" error when we send request to remote server. Log from remote server Cisco TCP Connection Terminated,Nov 05 14:43:39 EST: %ASA-session-6-302014: Teardown TCP connection ...
0
votes
1answer
311 views

What's the meaning of `netstat -i` flags

When I run netstat -i in Linux, I get outputs like: Kernel Interface table Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg eth0 1500 0 0 0 0 0 ...
0
votes
2answers
853 views

HTTP attack - Too many connections & TIME_WAIT

I am running CentOS 6 with http -2.2.15 Going under HTTP attack, i can see many http process running. > netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n > 1 established) > ...
0
votes
1answer
119 views

Reverse-resolved address ending with .bng?

I routinely check netstat --tcp when ssh'ed into my server, but today found an odd hyphenated address format that I haven't seen before: Proto Recv Sent Local Address Foreign Address ...
0
votes
2answers
1k views

Why does netstat show Tomcat process listen to multiple ports?

The netstat output with the tomcat process(pid: 28899) is as followed: Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 ...
0
votes
1answer
2k views

Is this normal? Multiple httpd process

I'm testing a new Server. This isnt really a peak time for my server (2pm), but still its running a bit slow, I was checking the ESTABLISHED connections using the following command: # netstat -ntu | ...
0
votes
2answers
1k views

How to speed up a server using netstat & httpd.conf?

I'm using netstat commands to help optimize my httpd.conf correctly. Here are the results: netstat -an | grep -c :80 579 netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq ...
0
votes
3answers
642 views

Which local process is connected to given server on given port?

On Linux, I can simply: netstat -ntp | grep server_ip:port And I get PID and process name of the program that is making given connection. But how do I do it on Solaris?
0
votes
2answers
1k views

Numerous TIME-WAIT connections

I am running on a Solaris system. I wrote a Korn shell script that every 30 seconds runs this line: netstat -a | grep TIME-WAIT | wc -l This has been working fine for a year. Now I move into a new ...
0
votes
1answer
38 views

How to use non-deprecated tools like ss to get process id running on a port?

I am looking for a non-deprecated way of running a command like netstat -tulpn | grep 8000 to output information about an active port. Any suggestions on how to use a tool like ss to get the process ...
0
votes
2answers
64 views

Print last column containing spaces and special characters

I need a full path/command thats been execued to start a process thats exposed on the network - listens on tcp/udp . I did manage to get all of that using below "one liner": netstat -nlp46|tail -n +3 ...
0
votes
2answers
130 views

Display IP & TCP statistics per interface (netstat -s with interface)

Linux has the ability to display protocol statistics with netstat -s. The output looks something like: Excerpt: 7487 times unabled to send RST due to no memory TCPDSACKIgnoredOld: 817 ...
0
votes
1answer
170 views

IP routing Solaris 9 access the internet from local network

I am trying to configure the NICS on the Solaris Sparc server. My problem lies in getting out to the "Internet" from the local network. I have requested the NIC to receive a DHCP server address ...