Questions tagged [netstat]
netstat is a tool for viewing active network connections, listeners and sockets.
327
questions
1
vote
0
answers
1k
views
iptables traffic after forwarding
I have 2 servers
Server A and Server B
ServerA = 1.1.1.1
ServerB = 2.2.2.2
I am using ip-tables to send all traffic on port 80 to Server B
on Server (A) 1.1.1.1
i have done
iptables -t nat -A ...
1
vote
0
answers
988
views
Ghost tcp connections: ss sees them, nothing else does
We have a strange problem. Our remote server shows over 900 connections coming from our office over port 80:
# ss -n | grep ESTAB | grep $OFFICEIP | grep :80 | wc -l
935
Netstat shows a similar ...
0
votes
2
answers
4k
views
Display IP & TCP statistics per interface (netstat -s with interface)
Linux has the ability to display protocol statistics with netstat -s. The output looks something like:
Excerpt:
7487 times unabled to send RST due to no memory
TCPDSACKIgnoredOld: 817
...
1
vote
3
answers
4k
views
Limit Number of TCP connections in Linux Server, to avoid attack
I want to limit the number of TCP connections in Linux server, I have used the following command.
iptables -A INPUT -p tcp --syn --dport 80 -m connlimit
--connlimit-above 25 --connlimit-mask 32 -...
0
votes
1
answer
947
views
Port 80 doesn't work
I have a website in my ubuntu server 14.04, with apache2 server, and untils fews days go the site works fine but, today if I digit www.mydomain.com from my internal network it works but, if I try with ...
8
votes
5
answers
10k
views
Get number of TCP established connections
On a Linux server one can use netstat -tan | grep ESTABLISHED| wc -l but this will not work on a high load server with watch -n1.
Such approach works fine if the server is not very busy or the ...
5
votes
2
answers
10k
views
What causes “SYN to LISTEN sockets dropped”?
A quite busy proxy server has lots of "SYNs to LISTEN sockets dropped".
I learned one cause could be a too small backlog size. But in that case the "times the listen queue of a socket overflowed" ...
2
votes
5
answers
7k
views
Is there a netstat -s equivalent for windows?
I know that netstat -s exists on Windows, but it displays way less informations than on Linux/OS X.
It only gives 8 counters about TCP, while on Linux it's more than 50.
I'm looking for any TCP-...
5
votes
1
answer
6k
views
What does it mean for netstat -t
I see the help of netstat -t option says Displays the current connection offload state.
And I tried it in the windows command console.
The Offload State value display InHost.
What does Offload ...
1
vote
2
answers
11k
views
Netstat count TIME_WAIT connections by port
I can obtain individual TIME_WAIT counts on a port,
netstat -nat | grep :11300 | grep TIME_WAIT | wc -l;
but how to do this based on all ports eg:
11300 2900 connection
3306 1200 connection
...
3
votes
0
answers
675
views
netstat e on windows shows really high bytes count
running netstat /e is giving me strange results
"bytes received" from netstat /e output is always way higher, about 10 times higher than when netsh interface ip show subinterfaces is run. wireshark ...
3
votes
2
answers
694
views
Difference Between Netstat and Access Log
When I was checking stats in SSH terminal for my VPS, I noticed that netstat and access log gives different results.
When I used:
netstat -anp
I saw that one attacker having 32 concurrent ...
0
votes
3
answers
1k
views
there is empty ips in netstat
I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip.
and when I run this command on ssh I see:
netstat -ntu | awk '{...
5
votes
2
answers
5k
views
After kill -9 process won't disappear and port is still bound
We have a Java server application running on Mac OS X.
Occasionally this application has become unresponsive, and we have resorted to killing it with kill -9. However, the process doesn't disappear; ...
1
vote
2
answers
3k
views
What are records in 'netstat' command are when using logstash?
I use logstash with embedded elasticsearch. My logstash config looks like the following:
output {
tdout { debug => true debug_format => "json"}
elasticsearch {
embedded => true
...
1
vote
2
answers
10k
views
How to find the count of Apache workers' at a given point for shared IPs?
One can find the number of Apache workers an IP address is consuming at an instantaneous point in time by executing:
netstat -pantu | grep :80 |sort | uniq -c |grep <IP_HERE, eg: 192.168> | wc -...
1
vote
2
answers
2k
views
Can I find the list of ports being listened by a process ordered by the time of opening?
I know I can see the list of open ports using the lsof command.
I am trying to view the results ordered by timestamp of listening.
The process opens multiple (~6) ports and I suspect the order of ...
-2
votes
2
answers
393
views
How to get the number of current connections to an external web service [closed]
My application makes many requests in a day to a webservice (say 172.20.20.20:11111) on a different server.
I would like to know how I can count the number of connections that are established (the ...
0
votes
2
answers
1k
views
netstat brought up strange ip
I just ran netstat -vatn and found there was a connection ESTABLISHED on :22 from my ip and another unknown ip. Moments later I ran it again and found the connection was gone.
I have a default ...
6
votes
1
answer
8k
views
What does "connections reset due to unexpected data" in netstat -s mean
I'm running a memcached server under heavy load from multiple web servers. While investigating some odd app level behaviour, we spotted that netstat -s on the memcached box was showing a lot of "...
14
votes
1
answer
11k
views
Netstat hangs: why?
Sometimes (not too often at all) when I type "netstat", it takes over 5 seconds to return. While other times is instantaneous.
I have been observing this for weeks on my server (CentOS 6.4), but I ...
0
votes
2
answers
23k
views
How does netstat get a hostname from IP while nslookup & nblookup fail every time?
In Windows Server 2003, when I run netstat with no flags, it takes much longer than netstat -n to return results. I realize this is because it has to perform reverse lookups by IP address to get the ...
1
vote
1
answer
4k
views
Lots of TIME_WAIT from same IP address
I've seen a lot of questions with people concerned about lots of TIME_WAITs in netstat. I'm having a similar problem but all the TIME_WAITs are coming from the same IP address. I get over 200 of the ...
5
votes
3
answers
5k
views
How to find full process arguments and associated listening ports?
I can execute netstat -atulpn | grep java to find all Java processes with their accompanying ports, which is great, however I would like to also have the processes full execution arguments also shown. ...
3
votes
1
answer
2k
views
Find number of TCP bytes transmitted
I have rhel4 and rhel6 hosts.
I can use netstat -s to see information on the number of segments sent/received. I can use ifconfig to see the number of bytes sent/received on a given interface (for ...
6
votes
2
answers
9k
views
UDP port appears to be in use but is not shown in netstat or TCPView
I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen ...
1
vote
2
answers
2k
views
Why is netstat -n different between Solaris and Linux and how can I make it the same?
When I run netstat -n on Solaris I get different results from netstat -n on Linux,
even though according to the manual pages in Solaris and Linux the -n flag should do the same thing.
My question:
...
1
vote
2
answers
1k
views
Linux: Find amount of "active" connections on one port
i need to monitor how many users are actively connected to one port on debian. I know i can do it with command
netstat -na |grep $port |grep ESTABLISHED |wc -l
which really gives me result - a ...
2
votes
1
answer
1k
views
Cannot install net-tools on Red Hat Linux
The isolated networking lab is running Red Hat Linux 9 (Shrike). We still use this "ancient" release, because given the simplicity of the protocols examined, it is sufficient. In addition, because of ...
0
votes
1
answer
5k
views
Application Unable connect Remote Server. FIREWALL Issue
Developing a C# Application that uses an WDSL/SOAP service and connects to a server via port 443
I know it is a Firewall Windows 2008 Server issue. Because when I disable it, it works perfectly. ...
1
vote
1
answer
5k
views
Random TCP Resets
We got randomly TCP "reset" error when we send request to remote server.
Log from remote server
Cisco TCP Connection Terminated,Nov 05 14:43:39 EST: %ASA-session-6-302014: Teardown TCP connection ...
0
votes
1
answer
821
views
how to display netstat output on nagios
Can you please tell me how to monitor an established connection (on a specified port) in a windows machine from nagios (centOS) here an example (output of netstat):
Proto Local Address ...
0
votes
1
answer
384
views
IP routing Solaris 9 access the internet from local network
I am trying to configure the NICS on the Solaris Sparc server.
My problem lies in getting out to the "Internet" from the local network.
I have requested the NIC to receive a DHCP server address
#...
0
votes
1
answer
145
views
Strange ports on default install of W7
I have a base new install of windows 7, and when I went to look for something else I saw the attached netstat output.
What concerns me is that this is Windows + Truecrypt + drivers, nothing else ...
2
votes
2
answers
529
views
Determine from where is "sh" being run under apache www-data user using using PF or NETSTAT [duplicate]
I am working with a compromised Ubuntu 8.04 Plesk 9.5.4 server. It seems that a script on the server is continuously doing reverse lookups to random IPs on the Internet.
I first spotted it during by ...
5
votes
3
answers
8k
views
How found suspect connection in a netstat output?
It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ?
...
2
votes
2
answers
1k
views
How to map an ephemeral port to a pid?
I have a RHEL server with several apps on it and I am attempting to figure out which one of them is making calls to an external web service. I have TCP dumps that show the calls being made and through ...
13
votes
2
answers
39k
views
Check nginx active connection without HttpStubStatusModule
We want to check the number of active connections without the module HttpStubStatusModule being installed.
What would be the equivalent Linux command?
As a base line, we test on a machine with ...
1
vote
1
answer
3k
views
What's the meaning of `netstat -i` flags
When I run netstat -i in Linux, I get outputs like:
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 1500 0 0 0 0 0 ...
2
votes
2
answers
3k
views
HTTP attack - Too many connections & TIME_WAIT
I am running CentOS 6 with http -2.2.15
Going under HTTP attack, i can see many http process running.
> netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n
> 1 established)
> ...
9
votes
1
answer
32k
views
Too many established connections left open
I have a (probably quite old) CentOS 4.5 server with a custom java application running inside.
I found the application was crashing after some running time and found it was handling 1024 connections ...
0
votes
1
answer
1k
views
Netstat doesn't work on FreeBSD by php function exec()
In my php-app I need the list of all IP's connected on port 80. I've chosen to do it this way:
<?php
$ips = exec("netstat -an |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -...
1
vote
1
answer
1k
views
Apache2 many CLOSE_WAIT. LAMP. Locating the issue
I've got a LAMP setup running and I seem to have many CLOSE_WAIT connections for apache2 program when I netstat (several hundred). This eventually causes my apache to become unresponsive.
Bellow is ...
0
votes
1
answer
205
views
Reverse-resolved address ending with .bng?
I routinely check netstat --tcp when ssh'ed into my server, but today found an odd hyphenated address format that I haven't seen before:
Proto Recv Sent Local Address Foreign Address ...
0
votes
1
answer
5k
views
How to check if sockets are sending/receiving data on linux?
I often have to debug processes which involve a server client tcp connection. I'd like to check, during times where a client might seem stuck, whether the server is sending it data or not. I can use:
...
0
votes
2
answers
4k
views
Find IP addresses with most connections on system
I am currently experiencing some attacks on my OpenVZ server (CentOS 6.3 64bit), which is saturating the public ethernet interface (currently accessing SSH via the private interface).
Is it possible ...
3
votes
1
answer
138
views
What is a good way to determine a server's connection usage?
Trying to figure out where my system's connections are being used (i.e. how many connections belong to what processes - could even be filtered by some expression through grep, if it applies). The ...
0
votes
1
answer
1k
views
No response from IIS
My problem is that the Default Web Site can be opened from the server machine (localhost), but cannot be opened from a test machine (which is in the same LAN). Netstat says that IIS 7.5 is listening ...
0
votes
1
answer
704
views
How can I find the cause of an unknown connection showing in iftop?
I have connections like this showing frequently in iftop:
12.15.127.75.host.nwnx.net => 121.61.153.172 480b 160b 40b
I have no idea ...
2
votes
1
answer
2k
views
Can't Access CouchDB Remotely
Please keep in mind that I have this installed on an Amazon EC2 instance running the latest version of Ubuntu Server.
I have changed the bind_address to 0.0.0.0.
netstat -an | grep 5984 yields the ...