netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

2
votes
1answer
691 views

Netstat shows two sshd's listening, but only one pid

On my Linode sudo netstat -tulp gives me: Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 *:ssh *:* LISTEN 2030/sshd ...
0
votes
3answers
105 views

apache is up but does not read requests

This usually happens a few minutes after restarting apache: httpd daemons are up, but are not reading the requests from the sockets. The web clients just wait forever on the connection. When I run ...
7
votes
3answers
13k views

netstat -ntap doesn't show pid/process name for some connections?

I have ubuntu/hardy server, with kernel 2.6.24-23-server and netstat: # netstat --version net-tools 1.60 netstat 1.42 (2001-04-15) The problem is that we have a lot of ESTABLISHED connections that ...
0
votes
1answer
410 views

How can I force a refresh of what ports have listeners

I'm trying to re-launch a WCF service that I killed earlier, but I'm getting an AddressAlreadyInUseException. The port it's attempting to use is 1819. I ran netstat -nao from the command line, and ...
1
vote
4answers
2k views

Make a process listen on 0.0.0.0 (or not 127.0.0.1)

Both boxes in question are RHEL5. I have a python RPC server running on localhost port 8000. When a client running on the same machine tries to connect, everything works great. When a remote client ...
1
vote
1answer
183 views

Netstat flags on OS/2

On an OS/2 box, what do the flags UGDP mean in the output of netstat -r. Google seems to point to them meaning Up, Gateway (i.e. an indirect root), and Dynamic (learned from a redirect), but that ...
56
votes
4answers
55k views

What's the difference between ip address 0.0.0.0 and 127.0.0.1?

I do know that 127.0.0.1 ~ 127.255.255.254 are the loopback IP addresses for most modern operating systems and we could use these IP addresses to refer to our own computer. But what's 0.0.0.0? It ...
5
votes
4answers
10k views

Running lsof -i shows a lot of connections in CLOSE_WAIT ? Should I worry

So I am running lsof -i | wc -l periodically and it is telling me that out of 420 lines, between 240 and 255 are in CLOSE_WAIT state. How does TCP connections enter this state ? Should I be worried ...
3
votes
6answers
18k views

Port 80 is being used by SYSTEM (PID 4), what is that?

I am trying to use port 80 for my application server, but when I perform "netstat -aon" I get TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 When I look up the process in ...
-1
votes
2answers
832 views

how can i hide a connection in netstat output?

OS: Windows Server Edition Basically i want use some other computer's internet connection by making a transparent proxy on target computer.. And i dont want this to be detected... I have heard that ...
2
votes
4answers
979 views

How to avoid external Javascript problem hanging server?

I've been having a strange problem with externally linked Javascript libraries hanging my load balancer server running HAProxy. I recently integrated the Quantcast monitoring script, and it worked ...
3
votes
5answers
5k views

Network port open, but no process attached?

I have a weird situation going on with an open network port. My main question is, why would there not be a program associated with an open TCP port: netstat -ln --program Active Internet connections ...
2
votes
1answer
844 views

What exactly does tcpOutAckDelayed mean, and is it a problem if it's counting up?

What does tcpOutAckDelayed mean, and what causes it to count up? is it an indication of problems or not? The sun doco isnt clear! Thanks, Dan
0
votes
2answers
1k views

Numerous TIME-WAIT connections

I am running on a Solaris system. I wrote a Korn shell script that every 30 seconds runs this line: netstat -a | grep TIME-WAIT | wc -l This has been working fine for a year. Now I move into a new ...
0
votes
2answers
2k views

The PID and name of the program to which socket belongs

Using 'netstat -tulp' on my server box running under CentOS I have discovered strange listening ports 33363 (TCP) and 35661 (UDP). The thing is that 'PID/Program name' field for these ports contains ...
5
votes
4answers
2k views

TCP monitoring on a server: comparing netstat vs lsof?

I'm monitoring the TCP stack on a server hoping to generically infer problems with application on the box. My first inclination is to measure the number of sockets in all reported states ...
11
votes
5answers
51k views

Huge amount of TIME_WAIT connections says netstat

Okay, this is creeping me out - I see about 1500-2500 of these: root@wherever:# netstat Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 ...
6
votes
3answers
2k views

Semantics of :: and 0.0.0.0 in dual-stack OSes

Back in the IPv4-only days, a LISTEN connection showing in netstat as listening on 0.0.0.0 would respond to connections on any IPv4 interface in the system. As I understand it, the new IPv6 idiom :: ...
1
vote
2answers
1k views

How to find the other point of a Unix domain socket on Mac OS X to write/read it?

I listed open file for a process (a daemon) on my box which runs Mac OS X 10.5 : >lsof -p 89 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME ... xxxxx 89 xxxxxxxx 9u unix ...
9
votes
6answers
24k views

How do I get rid of sockets in FIN_WAIT1 state?

I have a port that is blocked by a process I needed to kill. (a little telnet daemon that crashed) The process was killed successfully but the port is still in a 'FIN_WAIT1' state. It doesn't come out ...