Questions tagged [netstat]

netstat is a tool for viewing active network connections, listeners and sockets.

Filter by
Sorted by
Tagged with
1 vote
0 answers
1k views

iptables traffic after forwarding

I have 2 servers Server A and Server B ServerA = 1.1.1.1 ServerB = 2.2.2.2 I am using ip-tables to send all traffic on port 80 to Server B on Server (A) 1.1.1.1 i have done iptables -t nat -A ...
Ra Fay's user avatar
  • 21
1 vote
0 answers
988 views

Ghost tcp connections: ss sees them, nothing else does

We have a strange problem. Our remote server shows over 900 connections coming from our office over port 80: # ss -n | grep ESTAB | grep $OFFICEIP | grep :80 | wc -l 935 Netstat shows a similar ...
Mediocre Gopher's user avatar
0 votes
2 answers
4k views

Display IP & TCP statistics per interface (netstat -s with interface)

Linux has the ability to display protocol statistics with netstat -s. The output looks something like: Excerpt: 7487 times unabled to send RST due to no memory TCPDSACKIgnoredOld: 817 ...
data's user avatar
  • 111
1 vote
3 answers
4k views

Limit Number of TCP connections in Linux Server, to avoid attack

I want to limit the number of TCP connections in Linux server, I have used the following command. iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 25 --connlimit-mask 32 -...
Mani's user avatar
  • 215
0 votes
1 answer
947 views

Port 80 doesn't work

I have a website in my ubuntu server 14.04, with apache2 server, and untils fews days go the site works fine but, today if I digit www.mydomain.com from my internal network it works but, if I try with ...
Fabio's user avatar
  • 1
8 votes
5 answers
10k views

Get number of TCP established connections

On a Linux server one can use netstat -tan | grep ESTABLISHED| wc -l but this will not work on a high load server with watch -n1. Such approach works fine if the server is not very busy or the ...
Vinicius Tinti's user avatar
5 votes
2 answers
10k views

What causes “SYN to LISTEN sockets dropped”?

A quite busy proxy server has lots of "SYNs to LISTEN sockets dropped". I learned one cause could be a too small backlog size. But in that case the "times the listen queue of a socket overflowed" ...
edlerd's user avatar
  • 856
2 votes
5 answers
7k views

Is there a netstat -s equivalent for windows?

I know that netstat -s exists on Windows, but it displays way less informations than on Linux/OS X. It only gives 8 counters about TCP, while on Linux it's more than 50. I'm looking for any TCP-...
jean-loup's user avatar
  • 126
5 votes
1 answer
6k views

What does it mean for netstat -t

I see the help of netstat -t option says Displays the current connection offload state. And I tried it in the windows command console. The Offload State value display InHost. What does Offload ...
Joe.wang's user avatar
  • 151
1 vote
2 answers
11k views

Netstat count TIME_WAIT connections by port

I can obtain individual TIME_WAIT counts on a port, netstat -nat | grep :11300 | grep TIME_WAIT | wc -l; but how to do this based on all ports eg: 11300 2900 connection 3306 1200 connection ...
Pentium10's user avatar
  • 444
3 votes
0 answers
675 views

netstat e on windows shows really high bytes count

running netstat /e is giving me strange results "bytes received" from netstat /e output is always way higher, about 10 times higher than when netsh interface ip show subinterfaces is run. wireshark ...
ljk's user avatar
  • 131
3 votes
2 answers
694 views

Difference Between Netstat and Access Log

When I was checking stats in SSH terminal for my VPS, I noticed that netstat and access log gives different results. When I used: netstat -anp I saw that one attacker having 32 concurrent ...
NecNecco's user avatar
  • 221
0 votes
3 answers
1k views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk '{...
Mehdi Azizi's user avatar
5 votes
2 answers
5k views

After kill -9 process won't disappear and port is still bound

We have a Java server application running on Mac OS X. Occasionally this application has become unresponsive, and we have resorted to killing it with kill -9. However, the process doesn't disappear; ...
Robert Tupelo-Schneck's user avatar
1 vote
2 answers
3k views

What are records in 'netstat' command are when using logstash?

I use logstash with embedded elasticsearch. My logstash config looks like the following: output { tdout { debug => true debug_format => "json"} elasticsearch { embedded => true ...
Erik's user avatar
  • 213
1 vote
2 answers
10k views

How to find the count of Apache workers' at a given point for shared IPs?

One can find the number of Apache workers an IP address is consuming at an instantaneous point in time by executing: netstat -pantu | grep :80 |sort | uniq -c |grep <IP_HERE, eg: 192.168> | wc -...
ylluminate's user avatar
  • 1,197
1 vote
2 answers
2k views

Can I find the list of ports being listened by a process ordered by the time of opening?

I know I can see the list of open ports using the lsof command. I am trying to view the results ordered by timestamp of listening. The process opens multiple (~6) ports and I suspect the order of ...
rajeshnair's user avatar
-2 votes
2 answers
393 views

How to get the number of current connections to an external web service [closed]

My application makes many requests in a day to a webservice (say 172.20.20.20:11111) on a different server. I would like to know how I can count the number of connections that are established (the ...
Phil's user avatar
  • 133
0 votes
2 answers
1k views

netstat brought up strange ip

I just ran netstat -vatn and found there was a connection ESTABLISHED on :22 from my ip and another unknown ip. Moments later I ran it again and found the connection was gone. I have a default ...
N0M3's user avatar
  • 115
6 votes
1 answer
8k views

What does "connections reset due to unexpected data" in netstat -s mean

I'm running a memcached server under heavy load from multiple web servers. While investigating some odd app level behaviour, we spotted that netstat -s on the memcached box was showing a lot of "...
Malcolm Box's user avatar
14 votes
1 answer
11k views

Netstat hangs: why?

Sometimes (not too often at all) when I type "netstat", it takes over 5 seconds to return. While other times is instantaneous. I have been observing this for weeks on my server (CentOS 6.4), but I ...
Daniele B's user avatar
  • 367
0 votes
2 answers
23k views

How does netstat get a hostname from IP while nslookup & nblookup fail every time?

In Windows Server 2003, when I run netstat with no flags, it takes much longer than netstat -n to return results. I realize this is because it has to perform reverse lookups by IP address to get the ...
Nico M's user avatar
  • 21
1 vote
1 answer
4k views

Lots of TIME_WAIT from same IP address

I've seen a lot of questions with people concerned about lots of TIME_WAITs in netstat. I'm having a similar problem but all the TIME_WAITs are coming from the same IP address. I get over 200 of the ...
user213510's user avatar
5 votes
3 answers
5k views

How to find full process arguments and associated listening ports?

I can execute netstat -atulpn | grep java to find all Java processes with their accompanying ports, which is great, however I would like to also have the processes full execution arguments also shown. ...
ylluminate's user avatar
  • 1,197
3 votes
1 answer
2k views

Find number of TCP bytes transmitted

I have rhel4 and rhel6 hosts. I can use netstat -s to see information on the number of segments sent/received. I can use ifconfig to see the number of bytes sent/received on a given interface (for ...
JRG's user avatar
  • 133
6 votes
2 answers
9k views

UDP port appears to be in use but is not shown in netstat or TCPView

I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen ...
Guillermo Prandi's user avatar
1 vote
2 answers
2k views

Why is netstat -n different between Solaris and Linux and how can I make it the same?

When I run netstat -n on Solaris I get different results from netstat -n on Linux, even though according to the manual pages in Solaris and Linux the -n flag should do the same thing. My question: ...
Eytan's user avatar
  • 611
1 vote
2 answers
1k views

Linux: Find amount of "active" connections on one port

i need to monitor how many users are actively connected to one port on debian. I know i can do it with command netstat -na |grep $port |grep ESTABLISHED |wc -l which really gives me result - a ...
John's user avatar
  • 11
2 votes
1 answer
1k views

Cannot install net-tools on Red Hat Linux

The isolated networking lab is running Red Hat Linux 9 (Shrike). We still use this "ancient" release, because given the simplicity of the protocols examined, it is sufficient. In addition, because of ...
George's user avatar
  • 133
0 votes
1 answer
5k views

Application Unable connect Remote Server. FIREWALL Issue

Developing a C# Application that uses an WDSL/SOAP service and connects to a server via port 443 I know it is a Firewall Windows 2008 Server issue. Because when I disable it, it works perfectly. ...
kmxillo's user avatar
  • 113
1 vote
1 answer
5k views

Random TCP Resets

We got randomly TCP "reset" error when we send request to remote server. Log from remote server Cisco TCP Connection Terminated,Nov 05 14:43:39 EST: %ASA-session-6-302014: Teardown TCP connection ...
allenwei's user avatar
0 votes
1 answer
821 views

how to display netstat output on nagios

Can you please tell me how to monitor an established connection (on a specified port) in a windows machine from nagios (centOS) here an example (output of netstat): Proto Local Address ...
Abdelilah Benaou's user avatar
0 votes
1 answer
384 views

IP routing Solaris 9 access the internet from local network

I am trying to configure the NICS on the Solaris Sparc server. My problem lies in getting out to the "Internet" from the local network. I have requested the NIC to receive a DHCP server address #...
help_me's user avatar
  • 15
0 votes
1 answer
145 views

Strange ports on default install of W7

I have a base new install of windows 7, and when I went to look for something else I saw the attached netstat output. What concerns me is that this is Windows + Truecrypt + drivers, nothing else ...
Sabre's user avatar
  • 445
2 votes
2 answers
529 views

Determine from where is "sh" being run under apache www-data user using using PF or NETSTAT [duplicate]

I am working with a compromised Ubuntu 8.04 Plesk 9.5.4 server. It seems that a script on the server is continuously doing reverse lookups to random IPs on the Internet. I first spotted it during by ...
Eugene van der Merwe's user avatar
5 votes
3 answers
8k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
Benjamin BACKX's user avatar
2 votes
2 answers
1k views

How to map an ephemeral port to a pid?

I have a RHEL server with several apps on it and I am attempting to figure out which one of them is making calls to an external web service. I have TCP dumps that show the calls being made and through ...
jdw's user avatar
  • 3,855
13 votes
2 answers
39k views

Check nginx active connection without HttpStubStatusModule

We want to check the number of active connections without the module HttpStubStatusModule being installed. What would be the equivalent Linux command? As a base line, we test on a machine with ...
Howard's user avatar
  • 2,175
1 vote
1 answer
3k views

What's the meaning of `netstat -i` flags

When I run netstat -i in Linux, I get outputs like: Kernel Interface table Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg eth0 1500 0 0 0 0 0 ...
can.'s user avatar
  • 191
2 votes
2 answers
3k views

HTTP attack - Too many connections & TIME_WAIT

I am running CentOS 6 with http -2.2.15 Going under HTTP attack, i can see many http process running. > netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n > 1 established) > ...
Evan Hamlet's user avatar
9 votes
1 answer
32k views

Too many established connections left open

I have a (probably quite old) CentOS 4.5 server with a custom java application running inside. I found the application was crashing after some running time and found it was handling 1024 connections ...
Luke's user avatar
  • 391
0 votes
1 answer
1k views

Netstat doesn't work on FreeBSD by php function exec()

In my php-app I need the list of all IP's connected on port 80. I've chosen to do it this way: <?php $ips = exec("netstat -an |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -...
Andrei Zhamoida's user avatar
1 vote
1 answer
1k views

Apache2 many CLOSE_WAIT. LAMP. Locating the issue

I've got a LAMP setup running and I seem to have many CLOSE_WAIT connections for apache2 program when I netstat (several hundred). This eventually causes my apache to become unresponsive. Bellow is ...
D.Mill's user avatar
  • 379
0 votes
1 answer
205 views

Reverse-resolved address ending with .bng?

I routinely check netstat --tcp when ssh'ed into my server, but today found an odd hyphenated address format that I haven't seen before: Proto Recv Sent Local Address Foreign Address ...
xVagabondx's user avatar
0 votes
1 answer
5k views

How to check if sockets are sending/receiving data on linux?

I often have to debug processes which involve a server client tcp connection. I'd like to check, during times where a client might seem stuck, whether the server is sending it data or not. I can use: ...
Palace Chan's user avatar
0 votes
2 answers
4k views

Find IP addresses with most connections on system

I am currently experiencing some attacks on my OpenVZ server (CentOS 6.3 64bit), which is saturating the public ethernet interface (currently accessing SSH via the private interface). Is it possible ...
Justin's user avatar
  • 222
3 votes
1 answer
138 views

What is a good way to determine a server's connection usage?

Trying to figure out where my system's connections are being used (i.e. how many connections belong to what processes - could even be filtered by some expression through grep, if it applies). The ...
Juan Carlos Coto's user avatar
0 votes
1 answer
1k views

No response from IIS

My problem is that the Default Web Site can be opened from the server machine (localhost), but cannot be opened from a test machine (which is in the same LAN). Netstat says that IIS 7.5 is listening ...
kol's user avatar
  • 211
0 votes
1 answer
704 views

How can I find the cause of an unknown connection showing in iftop?

I have connections like this showing frequently in iftop: 12.15.127.75.host.nwnx.net => 121.61.153.172 480b 160b 40b I have no idea ...
rastaboym's user avatar
2 votes
1 answer
2k views

Can't Access CouchDB Remotely

Please keep in mind that I have this installed on an Amazon EC2 instance running the latest version of Ubuntu Server. I have changed the bind_address to 0.0.0.0. netstat -an | grep 5984 yields the ...
Willem Ellis's user avatar

1 2 3
4
5
7