netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

1
vote
1answer
295 views

How to see IPs of user using the most SYN_RECV, TIME_WAIT, etc?

Does anyone recommend (or have a netstat script) that will print the IP sending the most of X (where X is FIN_WAIT, SYN_RECV, etc.). Like, I have this netstat -nat | awk '{print $6}' | sort | uniq -...
1
vote
2answers
239 views

Averaging dstat output

I need to average upload and download speed using dstat -n. How can I add all the received and sent datas that appear after dstat -n, so that I can add them and find average upload and download ...
1
vote
1answer
899 views

How to remove the hint in the terminal?

As a normal user , when I run some command like ps\netstat, the terminal hint me: (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see ...
1
vote
1answer
1k views

Debian iptables, netstate. DDOS? [duplicate]

My server has been timing out and crashing lately. I ran this command: netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n Check the picture for result. ...
1
vote
1answer
1k views

How to reset netstat -e counters

I would like to reset netstat -e counters. How can I do it? Renewing the network interface may reset these counters, but it is NOT an option - the networking must not be interrupted. My OS is ...
1
vote
1answer
345 views

What's the difference between Send-Q and S-BCNT in FreeBSD netstat -anx?

What's the exact meaning of Send Buffer byte count in the extended netstat statistics, and why is it always bigger than Send-Q? In other words, what's counted against the S-BCNT that's not counted ...
1
vote
1answer
265 views

Process killing trouble

I am trying to program a server software which involves a lot of testing on java / scala platform. Whenever i compile and execute the code. It starts listening on port 80. Sometimes i need to ...
1
vote
1answer
808 views

High count packets rejects in established connections because of timestamp

I am trying to set up a Wowza media server using a Dell R710 with 24GB memory and a 10Gbit connection and all the calculations say it should be able to handle around 20k connections however when I get ...
1
vote
1answer
1k views

netstat on fresh install of Solaris 10 update 9

I am attempting to decipher the below output bash-3.00$ netstat -a UDP: IPv4 Local Address Remote Address State -------------------- -------------------- ---------- *.sunrpc ...
1
vote
1answer
1k views

Unknown connections to foreign hosts

When I run netstat -a, a lot of connections to foreign hosts show up. It's connected to a whole subnet, ie 123.123.123.x to the port 80. How can I see what is actually going on? My server doesn't look ...
1
vote
5answers
860 views

Httpd problem, suspect an attack but not sure

On one of my servers when I type netstat -n I get a huge output, something like 400 entries for httpd. The bandwidth on the server isn't high, so I'm confused as to what's causing it. I'm suspecting ...
1
vote
1answer
3k views

Ierrs on Network Interface - Pfsense/Freebsd

We're using PfSense as an internal router/firewall (no connection to WAN). Using the Web-GUI, under Status ---> Interfaces, there's one particular interface where I have some errors: In/out errors ...
1
vote
0answers
24 views

Why netstat -p doesn't show PID of established connections?

I have some REST service which is listening on tcp/8051 I'm querying this service with curl in infinite loop from the same host: while true; do curl --header "Authorization: Bearer ...
1
vote
0answers
21 views

How to aggregate reports given by nestat?

In this question OP gives some reports that has been generated with netstat. However, the more I look at the switches of netstat, the less I can find how to generate that report. The sample report is:...
1
vote
0answers
142 views

How to diagnose netstat: no namelist

I had to replace an NIC on my HP Proliant Microserver, running FreeNAS 9.3 In my crashplan jail, I now get "netstat: no namelist" as a response when I execute the netstat command. How to I diagnose ...
1
vote
0answers
24 views

How do you write the following command : if (netstat flag ==UG ) save addres IP [closed]

how How do you write the following command in ubuntu : if (netstat flag ==UG ) thene addres ip > new file I want to file contains : addres ip 152.123.12.1 123.12.12.123 ....
1
vote
1answer
239 views

Netstat showing multiple connections for on ssh login

I connect to my server via ssh. I am the only person who has access to connect to the server. After connecting via ssh, I run the following command: sudo netstat -tupn The output includes the ...
1
vote
0answers
79 views

What exactly constitutes a bad TCP segment?

What constitutes a bad segment as in bad segments received in the netstat output below? I would think a TCP header's checksum could do it, but are there other things? If a segment arrives after its ...
1
vote
2answers
46 views

See stats of data in and out of each connection to a port

I have an application listening to a port. The clients connect to it using http connection. At any given time I see around 3000 connections established. I assume not all these connections are in use (...
1
vote
0answers
268 views

TCP High Send-q coupled with FIN_WAIT1 status

I'm having a problem with one of my webservers, which is taking minutes to completely render a web page. I had a look at the TCP connection and noticed that I have a very high value in the send-q ...
1
vote
1answer
624 views

Port suddenly closed. How to re-open?

I've written a software module in PHP that manages the saving of data in different data stores (MySQL, ElasticSearch and Redis). To test the module, I've created several test plans in Apache JMeter, ...
1
vote
0answers
71 views

How to check a given connection has been offloaded to network card

From what I read, some part of the tcp protocol operation can be offloaded from kernel to network card driver thanks to TOE (or GSO, LSO, LRO..). My objective is too find if a given socket has some ...
1
vote
0answers
168 views

iptables traffic after forwarding

I have 2 servers Server A and Server B ServerA = 1.1.1.1 ServerB = 2.2.2.2 I am using ip-tables to send all traffic on port 80 to Server B on Server (A) 1.1.1.1 i have done iptables -t nat -A ...
1
vote
1answer
216 views

Limit Number of TCP connections in Linux Server, to avoid attack

I want to limit the number of TCP connections in Linux server, I have used the following command. iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 25 --connlimit-mask 32 -...
1
vote
1answer
173 views

Confusing traffic in netstat, nothing in logs

Just had a confusing couple of minutes! I was monitoring a screen (the gnu screen) running "netstat -a" and I noticed that there was one connection connected to http (port 80), fine. But when I ...
1
vote
0answers
364 views

how to get send-q and receive-q on windows server

in linux, is very easy to troubleshoot a remote connection problem because netstat show the send-q and recv-q. This is very useful because we can know if the remote peer is reading the server send ...
1
vote
1answer
327 views

apache2 won't start yet gives no error [closed]

I'm running apache2 on Debian testing on the Asus Slider sl101 tablet chrooted running on the android kernel. root@hoshi:/# root@hoshi:/# /etc/init.d/apache2 restart Restarting web server: apache2. ...
1
vote
1answer
552 views

nginx serving .php as static files

ok, again apparently a totally ridiculous problem which I just can't seem to figure out. nginx keeps serving my .php files as static files. I've installed nginx via the repositories on ubuntu. I've ...
1
vote
1answer
1k views

netstat -e: high discards and errors

I think my network is congested because of the relatively large discards and errors data. They should be zero or at least close to that. Here is the output of netstat -e on my computer: Interface ...
1
vote
1answer
200 views

Netstat flags on OS/2

On an OS/2 box, what do the flags UGDP mean in the output of netstat -r. Google seems to point to them meaning Up, Gateway (i.e. an indirect root), and Dynamic (learned from a redirect), but that ...
1
vote
1answer
1k views

Lots of TIME_WAIT from same IP address

I've seen a lot of questions with people concerned about lots of TIME_WAITs in netstat. I'm having a similar problem but all the TIME_WAITs are coming from the same IP address. I get over 200 of the ...
1
vote
2answers
471 views

Linux: How to display all sockets opened for a particular interface?

How can I display all sockets opened for a particular interface?
0
votes
1answer
193 views

Netstat - Thunderbird and others work on strange ports

I'm getting this: $ sudo netstat -alpv tcp 0 0 comp.local:35409 ey-in-f16.1e100.n:imaps ESTABLISHED 2782/thunderbird-bi tcp 0 0 comp.local:52950 ew-in-f16....
0
votes
2answers
2k views

Why is the port listed only in the specific format of netstat?

I have Tomcat and I am trying to bind to 2 specific ports (using custom connectors). E.g. port A and port B. Problem: When I do netstat -a |grep A I do NOT see the port listed. If I do netstat -antp I ...
0
votes
3answers
280 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk '{...
0
votes
1answer
130 views

Port scanning from localhost

I see lot of tcp connections on different ports on my server with 'TIME_WAIT' status. Just simple port scan, but i cant see ip address of this bastard because connections is going from my nginx. Can ...
0
votes
3answers
411 views

Is this hacking attempt?

on command netstat -na, between others, i'm getting next line: tcp 0 0 XXX.XXX.XXX.XXX:48746 YYY.YYY.YYY.YYY:80 TIME_WAIT is this some kind of hacking attempt? can you ...
0
votes
1answer
8k views

DDOS Attack detection with netstat [duplicate]

I have a server, today load of my server over 20, i was found a command that detect alive connection to server for DDOS detection and reject IP. netstat -anp | grep 'tcp\|udp' | awk '{print $5}' | ...
0
votes
3answers
2k views

Port listed as close-combat in netstat

Have just run netstat -A on my SQL Server and seen an established connection from one of our workstations on bmcw000340.domain:close-combat. My google-fu is failing me and I can't find out what close-...
0
votes
1answer
889 views

What causes “SYN to LISTEN sockets dropped”?

A quite busy proxy server has lots of "SYNs to LISTEN sockets dropped". I learned one cause could be a too small backlog size. But in that case the "times the listen queue of a socket overflowed" ...
0
votes
2answers
287 views

netstat brought up strange ip

I just ran netstat -vatn and found there was a connection ESTABLISHED on :22 from my ip and another unknown ip. Moments later I ran it again and found the connection was gone. I have a default ...
0
votes
1answer
596 views

What does this netstat output mean?

I run a moderately active website on a dedicated server. In the course of protecting against (D)DOS attacks, I ran netstat to get a count of active connections. This produced a rather unusual result ...
0
votes
2answers
3k views

netstat reports PID that doesn't exist - wtf and how do I close it?

I have an app that listens on port 7001, which sometimes crashes but leaves the port open. netstat reports a PID that doesn't exist. How is that possible? How can I force the port to close without ...
0
votes
3answers
2k views

Windows server 2008 & SQL - many connections in TIME_WAIT

When I run netstat, I get this: TCP xxxx:65524 65.55.11.162:80 TIME_WAIT 0 There are 13941 of such lines in netstat at this point. Server is running Windows 2008 & SQL ...
0
votes
1answer
484 views

Find IP addresses with most connections on system

I am currently experiencing some attacks on my OpenVZ server (CentOS 6.3 64bit), which is saturating the public ethernet interface (currently accessing SSH via the private interface). Is it possible ...
0
votes
1answer
307 views

Very strange localhost connections on linux workstation. Need help identifiying the source

The following is the output of netstat on a Ubuntu machine. Can someone help decrypt the output? I am especially curious what the ::1:43213 connection is. Also, why are there so many connections ...
0
votes
1answer
910 views

100 TIME_WAIT Connections to 1433 (sqlserver) port from one remote IP

What to do? Block that IP in firewall? What is this?
0
votes
3answers
108 views

apache is up but does not read requests

This usually happens a few minutes after restarting apache: httpd daemons are up, but are not reading the requests from the sockets. The web clients just wait forever on the connection. When I run ...
0
votes
1answer
48 views

Check number of connections to webserver port 80 AND 443

As the title says how would one check the number of open connections to a webserver on port 80 and 443? I'm currently using this oneliner to get the number of open connections per ipaddress from port ...
0
votes
1answer
48 views

How to Terminate specific TCP sessions without tcpkill

I found lot of TCP connections(listed through netstat) from my Linux server to windows server. I want to kill those sessions without tcpkill cmd how can I ? Please advise ..