Questions tagged [netstat]

netstat is a tool for viewing active network connections, listeners and sockets.

Filter by
Sorted by
Tagged with
1 vote
1 answer
543 views

How to see IPs of user using the most SYN_RECV, TIME_WAIT, etc?

Does anyone recommend (or have a netstat script) that will print the IP sending the most of X (where X is FIN_WAIT, SYN_RECV, etc.). Like, I have this netstat -nat | awk '{print $6}' | sort | uniq -...
kidcapital's user avatar
0 votes
1 answer
3k views

Apache creates lots of processes in CLOSE_WAIT state and than crashes

I have a web server (centos) with Apache 2.4.3 and in peak times Apache becomes unresponsive until I restart it. Before it happens there is suddenly spike of httpd proccesses count and it seems that ...
David's user avatar
  • 1
0 votes
1 answer
1k views

What does this netstat output mean?

I run a moderately active website on a dedicated server. In the course of protecting against (D)DOS attacks, I ran netstat to get a count of active connections. This produced a rather unusual result ...
cubiclemonk's user avatar
0 votes
1 answer
394 views

Apache SSL not accepting outside traffic

Running Apache 2 on Ubuntu 11 in Amazon EC2. Tried to add a new SSL VirtualHost by doing the following: Added "Listen 443" to ports.conf. Added new VirtualHost in my enabled site and "SSLEngine on". ...
WiggyBaggins's user avatar
0 votes
1 answer
2k views

Hundreds of local loopback TIME_WAIT connections on port 7080, Plesk [duplicate]

If I run netstat -tnep I see about two dozen or so regulra connections, then hundreds and hundreds of local loopback conenctions to port 7080. I assume this is something to do with Plesk, but could ...
Brandon - Free Palestine's user avatar
3 votes
2 answers
935 views

When using netstat on a listening port what is the difference between localhost:6666 and [::]:6666 in 'Local Address' field

Using ubuntu 11.04, I run netstat -nplt the results for local address may be localhost:6666 or [::]:6666 What is the difference? I believe that the [::]: binds the service at ...
Dave's user avatar
  • 377
8 votes
1 answer
106k views

Avoid TIME_WAIT connections [duplicate]

When I use netstat command it shows.. tcp 0 0 localhost:18056 localhost:mysql TIME_WAIT tcp 0 0 localhost:16683 localhost:mysql ...
Himanshu Matta's user avatar
1 vote
2 answers
2k views

Established connection to a blocked port, what does it mean?

I'm pretty new to system administration, and I've been trying to get more familiar with tools like netsat. If I run netstat -n on my server, I see this line: tcp 0 0 xxx.xxx.xxx.xxx:44573 ...
Brandon - Free Palestine's user avatar
1 vote
2 answers
615 views

Averaging dstat output

I need to average upload and download speed using dstat -n. How can I add all the received and sent datas that appear after dstat -n, so that I can add them and find average upload and download ...
Optimus Prime's user avatar
0 votes
4 answers
703 views

How to I start with a remote IP address connected to my computer to the process that has opened the connection?

If I type "netstat", I can see a list of IP addresses that my PC is connected to. If I start with an IP address, how do I find the process that has opened the connection to said IP address?
Contango's user avatar
  • 1,150
1 vote
1 answer
219 views

Confusing traffic in netstat, nothing in logs

Just had a confusing couple of minutes! I was monitoring a screen (the gnu screen) running "netstat -a" and I noticed that there was one connection connected to http (port 80), fine. But when I ...
Armer's user avatar
  • 11
0 votes
1 answer
407 views

Port scanning from localhost

I see lot of tcp connections on different ports on my server with 'TIME_WAIT' status. Just simple port scan, but i cant see ip address of this bastard because connections is going from my nginx. Can ...
Jaels's user avatar
  • 67
2 votes
2 answers
2k views

Why does netstat show Tomcat process listen to multiple ports?

The netstat output with the tomcat process(pid: 28899) is as followed: Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:...
twimo's user avatar
  • 151
3 votes
2 answers
6k views

FreeBSD Listen Queue Overflows - can't increase max queue size

I have a decently high trafficked FreeBSD Nginx server, and I'm starting to get a large number of listen queue overflows: [root@svr ~]# netstat -sp tcp | fgrep listen 80361931 listen queue overflows [...
Harry's user avatar
  • 221
0 votes
1 answer
741 views

Netstat shows Time_Wait in MySQL Master to master replication

During my master to master replication, I got a problem on telnet. After fixing it also my replication on both side doesn't work. Master 2 replicates all the database of Master 1 but Master 1 is ...
Udhy's user avatar
  • 103
10 votes
2 answers
4k views

Where are my TIME_WAITs on Mac OS X?

No TIME_WAITs on Mac OS X Normally, when a TCP connection is closed, the socket on the side where close() is called first is left in the TIME_WAIT state. When one of the peers is a Mac OS X (Lion) ...
mgd's user avatar
  • 267
1 vote
5 answers
30k views

netstat shows many times deploy.akamaitechnologies.com connected to my server

Many times, after running netstat on my server, I find one of IP addresses belonging to deploy.akamaitechnologies.com connected to my server, do someone has an idea on what is happening on my server ? ...
Sami-L's user avatar
  • 253
1 vote
1 answer
1k views

netstat outputs same local adress for 2 different connections

Trying to understand how to read netstat output. In my browser I opened site1.com On my server netstat -A inet -p -e outputs the following: tcp 0 0 site1.com:www foreign-adress:...
Under435's user avatar
14 votes
5 answers
32k views

linux : netstat listening queue length

Is there a way to view queue length on listening socket under Linux, the same way as netstat -L outputs for FreeBSD? I.e. you can see X/Y/Z in netstat -L output, but netstat under Linux doesn't ...
Artem G's user avatar
  • 371
0 votes
1 answer
633 views

Mountain Lion, How can I release port?

$ netstat -ltanp tcp | grep 8000 | grep LISTEN tcp4 0 0 *.8000 *.* LISTEN I want to release this port When I do $ lsof -i:8000 I get nothing I even ...
learner's user avatar
  • 163
3 votes
2 answers
584 views

What does "::" denote in windows netstat results?

I'm trying to understand on which interfaces a TCP port is open Using windows netstat command I get result like : TCP [::]:10000 MyMachineName:0 LISTENING What does the ...
Abhijeet Apsunde's user avatar
1 vote
1 answer
1k views

How to remove the hint in the terminal?

As a normal user , when I run some command like ps\netstat, the terminal hint me: (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see ...
jiangchengwu's user avatar
3 votes
2 answers
13k views

How to determine which TCP/UDP ports are being opened by a given process (linux)?

I know how to do the opposite (find out what process has a given port open) using lsof or netstat, but extensive research on Google hasn't helped me solve the reverse problem. I know I could use "...
Alex G's user avatar
  • 386
1 vote
3 answers
2k views

Find whats using all my servers bandwidth

TLDR: how can I dig deeper into my Mac mini OSX server to determine what processes are consuming so much bandwidth, or where all the inbound traffic is coming from? Resource caching is on, all ...
Benno's user avatar
  • 227
3 votes
1 answer
399 views

AIX: is it somehow possible to get a ForeignAddress/PID pair like we are able to get in Linux with netstat?

In Linux (RHEL), we are able to get a ForeignAddress/PID pair with "netstat -ntp" command: [root@rhel ~]# netstat -ntp Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address ...
user54614's user avatar
  • 379
1 vote
1 answer
2k views

Debian iptables, netstate. DDOS? [duplicate]

My server has been timing out and crashing lately. I ran this command: netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n Check the picture for result. Does ...
Muazam's user avatar
  • 197
3 votes
2 answers
3k views

iftop Shows Lots of Mysterious Connections - Not Showing in netstat

I've just stopped all pretty much all services except sshd on my server (Ubuntu Server 10.04), and when I run iftop I get output that looks like this: 12.5Kb 25.0Kb ...
HOLOGRAPHICpizza's user avatar
1 vote
1 answer
16k views

DDOS Attack detection with netstat [duplicate]

I have a server, today load of my server over 20, i was found a command that detect alive connection to server for DDOS detection and reject IP. netstat -anp | grep 'tcp\|udp' | awk '{print $5}' | ...
Akbar's user avatar
  • 11
1 vote
2 answers
542 views

Difference between two netstat results for Apache

We are running RedHat Linux on two front end webservers both running Apache HTTP Server. I have done a diff on both httpd.conf files and there are no differences but the server hostnames. We have ...
roacha's user avatar
  • 447
28 votes
5 answers
103k views

Netstat continuous refresh (watch changes the output)

I am using this simple command to monitor connections (to deal with some recent DoS attacks) on my Debian server: netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n How do I ...
Ruslan Osipov's user avatar
0 votes
1 answer
263 views

ss utility does't work properly

I've learned that ss, which is base on netlink, is much faster than netstat when amount of sockets is large. And the secret is here. But when I tested on my suse linux minutes ago, the result ...
user76927's user avatar
  • 109
4 votes
2 answers
6k views

How to know which process was using a port after it enters TIME_WAIT state?

On Linux, is there a way to figure out what process was using a port, before it went into TIME_WAIT state. When I use netstat -tnp I just see two end points, but no process information. Proto Recv-Q ...
user41183's user avatar
  • 143
-1 votes
0 answers
262 views

netstat showing too many connections (Established) [duplicate]

Possible Duplicate: Too Many ESTABLISHED connection from a single IP address in Apache netstat -ntp |grep 80 shows too many ESTABLISHED connection from single IP address. Around 300 of them and ...
LINUX4U's user avatar
  • 254
2 votes
3 answers
7k views

Too Many ESTABLISHED connection from a single IP address in Apache

netstat -ntp |grep 80 shows too many ESTABLISHED connection from single IP address. Around 300 of them and it is not an attack and user is using a 2G connection to access Apache. This is the case ...
ananthan's user avatar
  • 1,520
2 votes
3 answers
4k views

Unexplicated ssh connection from localhost through sshd to random localhost's port

I've tried to find out why I had some strange connections on my secure log file. Something like this : Apr 23 11:35:43 li192-61 sshd[11651]: Did not receive identification string from 127.0.0.1 Apr ...
alexgindre's user avatar
1 vote
2 answers
7k views

Why is the port listed only in the specific format of netstat?

I have Tomcat and I am trying to bind to 2 specific ports (using custom connectors). E.g. port A and port B. Problem: When I do netstat -a |grep A I do NOT see the port listed. If I do netstat -antp I ...
Jim's user avatar
  • 335
0 votes
1 answer
1k views

Very strange localhost connections on linux workstation. Need help identifiying the source

The following is the output of netstat on a Ubuntu machine. Can someone help decrypt the output? I am especially curious what the ::1:43213 connection is. Also, why are there so many connections ...
Max Brown's user avatar
1 vote
1 answer
2k views

How to utilise netstat information

We have an application named "Seamer" installed on 2008R2 machine named "R2DUO" which has IP address set as 192.61.247.37 in host file and 172.26.127.40 is IP address of Ethernet card .We have two ...
michale's user avatar
  • 11
0 votes
1 answer
1k views

fast opening and closing connection with a specific port

We have a Main application named "Trevor" installed in 2008R2 machine named "TEAMER12" which is slow now. One more application named "TVS" also running in and found there were many connections per ...
michale's user avatar
  • 11
7 votes
1 answer
9k views

Port 80 being used by Microsoft-HTTPAPI/2.0

It's been quite a few days that port is being used by some strange process which i don't know Initially i thought it's related to SQL Server. I tried stopping all the services which starts from SQL :)....
kgthenerd's user avatar
1 vote
1 answer
1k views

How to find malicious IPs?

Cacti shows irregular and pretty steady high bandwidth to my server (40x the normal) so I guess the server is udnder some sort of DDoS attack. The incoming bandwidth has not paralyzed my server, but ...
alfish's user avatar
  • 3,147
1 vote
1 answer
710 views

nginx serving .php as static files

ok, again apparently a totally ridiculous problem which I just can't seem to figure out. nginx keeps serving my .php files as static files. I've installed nginx via the repositories on ubuntu. I've ...
jcfrei's user avatar
  • 175
3 votes
3 answers
3k views

python reports socket in use, netstat and others claim its not

We have a strange socket issue with a RHES3 box: Python 2.4.1 (#1, Jul 5 2005, 19:17:11) [GCC 3.2.3 20030502 (Red Hat Linux 3.2.3-52)] Type "help", "copyright", "credits" or "license" for more ...
captainmish's user avatar
3 votes
2 answers
1k views

Interpreting Netstat output

I have a LAMP stack running Fedora 12 and I am run the following instruction through the command line on the server: netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | ...
Adrien Hingert's user avatar
1 vote
2 answers
724 views

How to measure bandwidth within the last 15 minutes?

I would like to log my bandwidth into a database and find out when my windows server 2003 is being used the most. I want to feed the database with the bandwidth passed from the last feed (let's say it'...
iTayb's user avatar
  • 791
2 votes
1 answer
6k views

How to reset netstat -e counters

I would like to reset netstat -e counters. How can I do it? Renewing the network interface may reset these counters, but it is NOT an option - the networking must not be interrupted. My OS is ...
Alex83's user avatar
  • 21
0 votes
1 answer
261 views

size of packet icmp with netstat TX

I am confused with the size of packet icmp. I just did a simple initial netstat, where for eth0 : TX-OK = 485 after 1 ping message is send, again I see in netstat TX-OK = 488 So, I just want to know ...
sateayam's user avatar
  • 137
0 votes
2 answers
6k views

restart counter in netstat

I am using Ubuntu. I need to count the number of packet received in a specific interface. I found this can be done using netstat. However, I need to count starting from t=zero until a specific time I ...
sateayam's user avatar
  • 137
2 votes
1 answer
5k views

netstat -e: high discards and errors

I think my network is congested because of the relatively large discards and errors data. They should be zero or at least close to that. Here is the output of netstat -e on my computer: Interface ...
Mywiki Witwiki's user avatar
1 vote
1 answer
465 views

What's the difference between Send-Q and S-BCNT in FreeBSD netstat -anx?

What's the exact meaning of Send Buffer byte count in the extended netstat statistics, and why is it always bigger than Send-Q? In other words, what's counted against the S-BCNT that's not counted ...
cjp's user avatar
  • 208

1
3 4
5
6 7