netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

0
votes
2answers
832 views

Why can't I access my Linux FTP (vsftpd) server?

I've just installed vsftpd, and started the service. The service is running, and my netstat dump shows it (See below). I've also enabled anonymous access for good measure. However, when I try to ...
0
votes
1answer
1k views

Port 8080 not visible while doing netstat?

While trying to run Tomcat on my Windows 2003 OS, I am noticing that the server is not running but at the same time it is not throwing any exceptions on the console. My first hunch was that the server ...
1
vote
2answers
422 views

Linux: How to display all sockets opened for a particular interface?

How can I display all sockets opened for a particular interface?
0
votes
2answers
803 views

Can't connect to local server

I'm migrating a client / server application from Linux to Windows and while the Linux version of the server works fine, the Windows version won't connect via localhost. While the program is trying to ...
2
votes
1answer
7k views

Lots of TIME_WAIT connections in netstat (Windows Server 2008)

I'm having some issues on a Windows 2008 server with some network connections not going through. For instance, in a web application on the server, we need to open a socket connection to another ...
1
vote
1answer
1k views

netstat on fresh install of Solaris 10 update 9

I am attempting to decipher the below output bash-3.00$ netstat -a UDP: IPv4 Local Address Remote Address State -------------------- -------------------- ---------- *.sunrpc ...
0
votes
2answers
2k views

netstat reports PID that doesn't exist - wtf and how do I close it?

I have an app that listens on port 7001, which sometimes crashes but leaves the port open. netstat reports a PID that doesn't exist. How is that possible? How can I force the port to close without ...
0
votes
1answer
1k views

In “The Social Network”, what linux program is Mark using to monitor traffic in near real-time? [duplicate]

Possible Duplicate: How to watch logs in real time via Terminal? The scene where Mark is monitoring TCP/IP connections to his Facemesh website, and comments "look at all this traffic". ...
9
votes
4answers
31k views

How do I make cURL use keepalive from the command line?

I'm trying to verify that HTTP persistent connections are being used during communication with a Tomcat webserver I've got running. Currently, I can retrieve a resource on my server from a browser ...
1
vote
1answer
718 views

Unknown connections to foreign hosts

When I run netstat -a, a lot of connections to foreign hosts show up. It's connected to a whole subnet, ie 123.123.123.x to the port 80. How can I see what is actually going on? My server doesn't look ...
0
votes
1answer
179 views

Netstat - Thunderbird and others work on strange ports

I'm getting this: $ sudo netstat -alpv tcp 0 0 comp.local:35409 ey-in-f16.1e100.n:imaps ESTABLISHED 2782/thunderbird-bi tcp 0 0 comp.local:52950 ...
1
vote
4answers
5k views

Showing date/time in netstat

Is it possible to have netstat show the date/time the connection was established? Is this information even stored anywhere in Linux?
0
votes
3answers
1k views

Windows server 2008 & SQL - many connections in TIME_WAIT

When I run netstat, I get this: TCP xxxx:65524 65.55.11.162:80 TIME_WAIT 0 There are 13941 of such lines in netstat at this point. Server is running Windows 2008 & SQL ...
0
votes
3answers
1k views

Port listed as close-combat in netstat

Have just run netstat -A on my SQL Server and seen an established connection from one of our workstations on bmcw000340.domain:close-combat. My google-fu is failing me and I can't find out what ...
2
votes
1answer
4k views

TIME_WAIT in netstat of Apache processes

What are the meaning of the TIME_WAIT when using netstat of my web server process? I am sure the web server is not over loaded. tcp 0 0 0.0.0.0:80 0.0.0.0:* ...
5
votes
3answers
2k views

In the output for netstat what does the [::] mean?

In the results for netstat what does the [::] mean? example [::]:ssh [::]:* LISTEN
4
votes
3answers
241 views

Windows Server 2008/2003 - determine all “used” local network ports

I have been tasked with enabling the local firewall on 100+ servers. The systems are running many different applications using many different ports. I began with an nmap scan, but without going to ...
0
votes
2answers
357 views

Netstat and strange activity

when i did some monitoring network activity of my server, using netstat -na, in a sec i noticed next, for me strange line: first it was: tcp 0 0 XXX.XXX.XXX.XXX:22 ...
0
votes
3answers
375 views

Is this hacking attempt?

on command netstat -na, between others, i'm getting next line: tcp 0 0 XXX.XXX.XXX.XXX:48746 YYY.YYY.YYY.YYY:80 TIME_WAIT is this some kind of hacking attempt? can you ...
5
votes
1answer
596 views

Why is rpc.lockd obscured from netstat/lsof output?

Prologue: On a number of machines, which happen to act as NFS clients, netstat reports two ports that are open with no PID listed for an associated daemon. Ordinarily this might be a bit concerning. ...
0
votes
1answer
61 views

Finding Network Status of specific process name

I am looking for the cleanest way on linux to find the port status for a port being used by a specified program name via the command line. I have seen that netstat -p lists all pids but haven't seen ...
1
vote
3answers
4k views

debugging spiking netstat “failed connection attempts” with iptables

http://farm4.static.flickr.com/3305/4588110530_a60c934289_o.png This graph is munin collecting netstat -s output. I want to determine where the connections are coming from. There is nothing obvious ...
1
vote
2answers
240 views

What can I use to monitor which IP address w/name resolution is connected to each PID?

This would be for under Linux particularly. Is there a tool out there, or a script that I could use to monitor IP connections--with name resolution--and, see which process they're connected to? ...
2
votes
1answer
206 views

Cannot Connect Via RDP

I cannot connect via RDP to a win2003 server. Terminal services say that they're started, but a netstat shows nothing to do with port 3389. Any ideas?
1
vote
5answers
764 views

Httpd problem, suspect an attack but not sure

On one of my servers when I type netstat -n I get a huge output, something like 400 entries for httpd. The bandwidth on the server isn't high, so I'm confused as to what's causing it. I'm suspecting ...
0
votes
1answer
763 views

100 TIME_WAIT Connections to 1433 (sqlserver) port from one remote IP

What to do? Block that IP in firewall? What is this?
0
votes
3answers
627 views

Which local process is connected to given server on given port?

On Linux, I can simply: netstat -ntp | grep server_ip:port And I get PID and process name of the program that is making given connection. But how do I do it on Solaris?
1
vote
1answer
1k views

lsof not showing what port a proc is listening on

I have many processes on a box listening on several ports. I am trying to map ports to pids. The problem is that lsof is not telling me what ports belong to which process. Given an apache listening ...
1
vote
1answer
2k views

Ierrs on Network Interface - Pfsense/Freebsd

We're using PfSense as an internal router/firewall (no connection to WAN). Using the Web-GUI, under Status ---> Interfaces, there's one particular interface where I have some errors: In/out errors ...
2
votes
1answer
598 views

Why netstat reporting incorrect machine names?

I need to investigate what clients connected to my application and I am using the netstat command for this. I noticed that sometimes it does not report me the correct machine name. Why this is ...
2
votes
1answer
860 views

Netstat shows two sshd's listening, but only one pid

On my Linode sudo netstat -tulp gives me: Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 *:ssh *:* LISTEN 2030/sshd ...
0
votes
3answers
107 views

apache is up but does not read requests

This usually happens a few minutes after restarting apache: httpd daemons are up, but are not reading the requests from the sockets. The web clients just wait forever on the connection. When I run ...
7
votes
3answers
16k views

netstat -ntap doesn't show pid/process name for some connections?

I have ubuntu/hardy server, with kernel 2.6.24-23-server and netstat: # netstat --version net-tools 1.60 netstat 1.42 (2001-04-15) The problem is that we have a lot of ESTABLISHED connections that ...
0
votes
1answer
520 views

How can I force a refresh of what ports have listeners

I'm trying to re-launch a WCF service that I killed earlier, but I'm getting an AddressAlreadyInUseException. The port it's attempting to use is 1819. I ran netstat -nao from the command line, and ...
1
vote
4answers
2k views

Make a process listen on 0.0.0.0 (or not 127.0.0.1)

Both boxes in question are RHEL5. I have a python RPC server running on localhost port 8000. When a client running on the same machine tries to connect, everything works great. When a remote client ...
1
vote
1answer
187 views

Netstat flags on OS/2

On an OS/2 box, what do the flags UGDP mean in the output of netstat -r. Google seems to point to them meaning Up, Gateway (i.e. an indirect root), and Dynamic (learned from a redirect), but that ...
83
votes
4answers
89k views

What's the difference between ip address 0.0.0.0 and 127.0.0.1?

I do know that 127.0.0.1 ~ 127.255.255.254 are the loopback IP addresses for most modern operating systems and we could use these IP addresses to refer to our own computer. But what's 0.0.0.0? It ...
6
votes
4answers
13k views

Running lsof -i shows a lot of connections in CLOSE_WAIT ? Should I worry

So I am running lsof -i | wc -l periodically and it is telling me that out of 420 lines, between 240 and 255 are in CLOSE_WAIT state. How does TCP connections enter this state ? Should I be worried ...
4
votes
7answers
22k views

Port 80 is being used by SYSTEM (PID 4), what is that?

I am trying to use port 80 for my application server, but when I perform "netstat -aon" I get TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 When I look up the process in ...
-1
votes
2answers
1k views

how can i hide a connection in netstat output?

OS: Windows Server Edition Basically i want use some other computer's internet connection by making a transparent proxy on target computer.. And i dont want this to be detected... I have heard that ...
2
votes
4answers
1k views

How to avoid external Javascript problem hanging server?

I've been having a strange problem with externally linked Javascript libraries hanging my load balancer server running HAProxy. I recently integrated the Quantcast monitoring script, and it worked ...
5
votes
5answers
6k views

Network port open, but no process attached?

I have a weird situation going on with an open network port. My main question is, why would there not be a program associated with an open TCP port: netstat -ln --program Active Internet connections ...
2
votes
1answer
1k views

What exactly does tcpOutAckDelayed mean, and is it a problem if it's counting up?

What does tcpOutAckDelayed mean, and what causes it to count up? is it an indication of problems or not? The sun doco isnt clear! Thanks, Dan
0
votes
2answers
1k views

Numerous TIME-WAIT connections

I am running on a Solaris system. I wrote a Korn shell script that every 30 seconds runs this line: netstat -a | grep TIME-WAIT | wc -l This has been working fine for a year. Now I move into a new ...
0
votes
2answers
1k views

The PID and name of the program to which socket belongs

Using 'netstat -tulp' on my server box running under CentOS I have discovered strange listening ports 33363 (TCP) and 35661 (UDP). The thing is that 'PID/Program name' field for these ports contains ...
7
votes
4answers
2k views

TCP monitoring on a server: comparing netstat vs lsof?

I'm monitoring the TCP stack on a server hoping to generically infer problems with application on the box. My first inclination is to measure the number of sockets in all reported states ...
14
votes
5answers
66k views

Huge amount of TIME_WAIT connections says netstat

Okay, this is creeping me out - I see about 1500-2500 of these: root@wherever:# netstat Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 ...
7
votes
3answers
1k views

Semantics of :: and 0.0.0.0 in dual-stack OSes

Back in the IPv4-only days, a LISTEN connection showing in netstat as listening on 0.0.0.0 would respond to connections on any IPv4 interface in the system. As I understand it, the new IPv6 idiom :: ...
1
vote
2answers
1k views

How to find the other point of a Unix domain socket on Mac OS X to write/read it?

I listed open file for a process (a daemon) on my box which runs Mac OS X 10.5 : >lsof -p 89 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME ... xxxxx 89 xxxxxxxx 9u unix ...
10
votes
7answers
31k views

How do I get rid of sockets in FIN_WAIT1 state?

I have a port that is blocked by a process I needed to kill. (a little telnet daemon that crashed). The process was killed successfully but the port is still in a 'FIN_WAIT1' state. It doesn't come ...