netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

1
vote
5answers
705 views

Httpd problem, suspect an attack but not sure

On one of my servers when I type netstat -n I get a huge output, something like 400 entries for httpd. The bandwidth on the server isn't high, so I'm confused as to what's causing it. I'm suspecting ...
0
votes
1answer
684 views

100 TIME_WAIT Connections to 1433 (sqlserver) port from one remote IP

What to do? Block that IP in firewall? What is this?
0
votes
3answers
575 views

Which local process is connected to given server on given port?

On Linux, I can simply: netstat -ntp | grep server_ip:port And I get PID and process name of the program that is making given connection. But how do I do it on Solaris?
1
vote
1answer
1k views

lsof not showing what port a proc is listening on

I have many processes on a box listening on several ports. I am trying to map ports to pids. The problem is that lsof is not telling me what ports belong to which process. Given an apache listening ...
1
vote
1answer
2k views

Ierrs on Network Interface - Pfsense/Freebsd

We're using PfSense as an internal router/firewall (no connection to WAN). Using the Web-GUI, under Status ---> Interfaces, there's one particular interface where I have some errors: In/out errors ...
2
votes
1answer
536 views

Why netstat reporting incorrect machine names?

I need to investigate what clients connected to my application and I am using the netstat command for this. I noticed that sometimes it does not report me the correct machine name. Why this is ...
2
votes
1answer
740 views

Netstat shows two sshd's listening, but only one pid

On my Linode sudo netstat -tulp gives me: Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 *:ssh *:* LISTEN 2030/sshd ...
0
votes
3answers
105 views

apache is up but does not read requests

This usually happens a few minutes after restarting apache: httpd daemons are up, but are not reading the requests from the sockets. The web clients just wait forever on the connection. When I run ...
7
votes
3answers
14k views

netstat -ntap doesn't show pid/process name for some connections?

I have ubuntu/hardy server, with kernel 2.6.24-23-server and netstat: # netstat --version net-tools 1.60 netstat 1.42 (2001-04-15) The problem is that we have a lot of ESTABLISHED connections that ...
0
votes
1answer
443 views

How can I force a refresh of what ports have listeners

I'm trying to re-launch a WCF service that I killed earlier, but I'm getting an AddressAlreadyInUseException. The port it's attempting to use is 1819. I ran netstat -nao from the command line, and ...
1
vote
4answers
2k views

Make a process listen on 0.0.0.0 (or not 127.0.0.1)

Both boxes in question are RHEL5. I have a python RPC server running on localhost port 8000. When a client running on the same machine tries to connect, everything works great. When a remote client ...
1
vote
1answer
185 views

Netstat flags on OS/2

On an OS/2 box, what do the flags UGDP mean in the output of netstat -r. Google seems to point to them meaning Up, Gateway (i.e. an indirect root), and Dynamic (learned from a redirect), but that ...
61
votes
4answers
64k views

What's the difference between ip address 0.0.0.0 and 127.0.0.1?

I do know that 127.0.0.1 ~ 127.255.255.254 are the loopback IP addresses for most modern operating systems and we could use these IP addresses to refer to our own computer. But what's 0.0.0.0? It ...
5
votes
4answers
11k views

Running lsof -i shows a lot of connections in CLOSE_WAIT ? Should I worry

So I am running lsof -i | wc -l periodically and it is telling me that out of 420 lines, between 240 and 255 are in CLOSE_WAIT state. How does TCP connections enter this state ? Should I be worried ...
3
votes
7answers
19k views

Port 80 is being used by SYSTEM (PID 4), what is that?

I am trying to use port 80 for my application server, but when I perform "netstat -aon" I get TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 When I look up the process in ...
-1
votes
2answers
888 views

how can i hide a connection in netstat output?

OS: Windows Server Edition Basically i want use some other computer's internet connection by making a transparent proxy on target computer.. And i dont want this to be detected... I have heard that ...
2
votes
4answers
1k views

How to avoid external Javascript problem hanging server?

I've been having a strange problem with externally linked Javascript libraries hanging my load balancer server running HAProxy. I recently integrated the Quantcast monitoring script, and it worked ...
3
votes
5answers
5k views

Network port open, but no process attached?

I have a weird situation going on with an open network port. My main question is, why would there not be a program associated with an open TCP port: netstat -ln --program Active Internet connections ...
2
votes
1answer
897 views

What exactly does tcpOutAckDelayed mean, and is it a problem if it's counting up?

What does tcpOutAckDelayed mean, and what causes it to count up? is it an indication of problems or not? The sun doco isnt clear! Thanks, Dan
0
votes
2answers
1k views

Numerous TIME-WAIT connections

I am running on a Solaris system. I wrote a Korn shell script that every 30 seconds runs this line: netstat -a | grep TIME-WAIT | wc -l This has been working fine for a year. Now I move into a new ...
0
votes
2answers
2k views

The PID and name of the program to which socket belongs

Using 'netstat -tulp' on my server box running under CentOS I have discovered strange listening ports 33363 (TCP) and 35661 (UDP). The thing is that 'PID/Program name' field for these ports contains ...
6
votes
4answers
2k views

TCP monitoring on a server: comparing netstat vs lsof?

I'm monitoring the TCP stack on a server hoping to generically infer problems with application on the box. My first inclination is to measure the number of sockets in all reported states ...
12
votes
5answers
57k views

Huge amount of TIME_WAIT connections says netstat

Okay, this is creeping me out - I see about 1500-2500 of these: root@wherever:# netstat Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 ...
6
votes
3answers
2k views

Semantics of :: and 0.0.0.0 in dual-stack OSes

Back in the IPv4-only days, a LISTEN connection showing in netstat as listening on 0.0.0.0 would respond to connections on any IPv4 interface in the system. As I understand it, the new IPv6 idiom :: ...
1
vote
2answers
1k views

How to find the other point of a Unix domain socket on Mac OS X to write/read it?

I listed open file for a process (a daemon) on my box which runs Mac OS X 10.5 : >lsof -p 89 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME ... xxxxx 89 xxxxxxxx 9u unix ...
9
votes
7answers
26k views

How do I get rid of sockets in FIN_WAIT1 state?

I have a port that is blocked by a process I needed to kill. (a little telnet daemon that crashed) The process was killed successfully but the port is still in a 'FIN_WAIT1' state. It doesn't come out ...