Questions tagged [netstat]
netstat is a tool for viewing active network connections, listeners and sockets.
327
questions
1
vote
1
answer
543
views
How to see IPs of user using the most SYN_RECV, TIME_WAIT, etc?
Does anyone recommend (or have a netstat script) that will print the IP sending the most of X (where X is FIN_WAIT, SYN_RECV, etc.).
Like, I have this
netstat -nat | awk '{print $6}' | sort | uniq -...
0
votes
1
answer
3k
views
Apache creates lots of processes in CLOSE_WAIT state and than crashes
I have a web server (centos) with Apache 2.4.3 and in peak times Apache becomes unresponsive until I restart it.
Before it happens there is suddenly spike of httpd proccesses count and it seems that ...
0
votes
1
answer
1k
views
What does this netstat output mean?
I run a moderately active website on a dedicated server. In the course of protecting against (D)DOS attacks, I ran netstat to get a count of active connections. This produced a rather unusual result ...
0
votes
1
answer
394
views
Apache SSL not accepting outside traffic
Running Apache 2 on Ubuntu 11 in Amazon EC2. Tried to add a new SSL VirtualHost by doing the following:
Added "Listen 443" to ports.conf.
Added new VirtualHost in my enabled site and "SSLEngine on".
...
0
votes
1
answer
2k
views
Hundreds of local loopback TIME_WAIT connections on port 7080, Plesk [duplicate]
If I run netstat -tnep I see about two dozen or so regulra connections, then hundreds and hundreds of local loopback conenctions to port 7080. I assume this is something to do with Plesk, but could ...
3
votes
2
answers
935
views
When using netstat on a listening port what is the difference between localhost:6666 and [::]:6666 in 'Local Address' field
Using ubuntu 11.04, I run netstat -nplt the results for local address may be
localhost:6666
or
[::]:6666
What is the difference?
I believe that the [::]: binds the service at ...
8
votes
1
answer
106k
views
Avoid TIME_WAIT connections [duplicate]
When I use netstat command it shows..
tcp 0 0 localhost:18056 localhost:mysql TIME_WAIT
tcp 0 0 localhost:16683 localhost:mysql ...
1
vote
2
answers
2k
views
Established connection to a blocked port, what does it mean?
I'm pretty new to system administration, and I've been trying to get more familiar with tools like netsat. If I run netstat -n on my server, I see this line:
tcp 0 0 xxx.xxx.xxx.xxx:44573 ...
1
vote
2
answers
615
views
Averaging dstat output
I need to average upload and download speed using dstat -n.
How can I add all the received and sent datas that appear after dstat -n, so that I can add them and find average upload and download ...
0
votes
4
answers
703
views
How to I start with a remote IP address connected to my computer to the process that has opened the connection?
If I type "netstat", I can see a list of IP addresses that my PC is connected to.
If I start with an IP address, how do I find the process that has opened the connection to said IP address?
1
vote
1
answer
219
views
Confusing traffic in netstat, nothing in logs
Just had a confusing couple of minutes! I was monitoring a screen (the gnu screen) running "netstat -a" and I noticed that there was one connection connected to http (port 80), fine. But when I ...
0
votes
1
answer
407
views
Port scanning from localhost
I see lot of tcp connections on different ports on my server with 'TIME_WAIT' status.
Just simple port scan, but i cant see ip address of this bastard because connections is going from my nginx.
Can ...
2
votes
2
answers
2k
views
Why does netstat show Tomcat process listen to multiple ports?
The netstat output with the tomcat process(pid: 28899) is as followed:
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:...
3
votes
2
answers
6k
views
FreeBSD Listen Queue Overflows - can't increase max queue size
I have a decently high trafficked FreeBSD Nginx server, and I'm starting to get a large number of listen queue overflows:
[root@svr ~]# netstat -sp tcp | fgrep listen
80361931 listen queue overflows
[...
0
votes
1
answer
741
views
Netstat shows Time_Wait in MySQL Master to master replication
During my master to master replication, I got a problem on telnet. After fixing it also my replication on both side doesn't work. Master 2 replicates all the database of Master 1 but Master 1 is ...
10
votes
2
answers
4k
views
Where are my TIME_WAITs on Mac OS X?
No TIME_WAITs on Mac OS X
Normally, when a TCP connection is closed, the socket on the side where close() is called first is left in the TIME_WAIT state.
When one of the peers is a Mac OS X (Lion) ...
1
vote
5
answers
30k
views
netstat shows many times deploy.akamaitechnologies.com connected to my server
Many times, after running netstat on my server, I find one of IP addresses belonging to deploy.akamaitechnologies.com connected to my server, do someone has an idea on what is happening on my server ?
...
1
vote
1
answer
1k
views
netstat outputs same local adress for 2 different connections
Trying to understand how to read netstat output.
In my browser I opened site1.com
On my server netstat -A inet -p -e outputs the following:
tcp 0 0 site1.com:www foreign-adress:...
14
votes
5
answers
32k
views
linux : netstat listening queue length
Is there a way to view queue length on listening socket under Linux, the same way as netstat -L outputs for FreeBSD? I.e. you can see X/Y/Z in netstat -L output, but netstat under Linux doesn't ...
0
votes
1
answer
633
views
Mountain Lion, How can I release port?
$ netstat -ltanp tcp | grep 8000 | grep LISTEN
tcp4 0 0 *.8000 *.* LISTEN
I want to release this port
When I do
$ lsof -i:8000
I get nothing
I even ...
3
votes
2
answers
584
views
What does "::" denote in windows netstat results?
I'm trying to understand on which interfaces a TCP port is open
Using windows netstat command I get result like :
TCP [::]:10000 MyMachineName:0 LISTENING
What does the ...
1
vote
1
answer
1k
views
How to remove the hint in the terminal?
As a normal user , when I run some command like ps\netstat, the terminal hint me:
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see ...
3
votes
2
answers
13k
views
How to determine which TCP/UDP ports are being opened by a given process (linux)?
I know how to do the opposite (find out what process has a given port open) using lsof or netstat, but extensive research on Google hasn't helped me solve the reverse problem.
I know I could use "...
1
vote
3
answers
2k
views
Find whats using all my servers bandwidth
TLDR: how can I dig deeper into my Mac mini OSX server to determine what processes are consuming so much bandwidth, or where all the inbound traffic is coming from?
Resource caching is on, all ...
3
votes
1
answer
399
views
AIX: is it somehow possible to get a ForeignAddress/PID pair like we are able to get in Linux with netstat?
In Linux (RHEL), we are able to get a ForeignAddress/PID pair with "netstat -ntp" command:
[root@rhel ~]# netstat -ntp
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address ...
1
vote
1
answer
2k
views
Debian iptables, netstate. DDOS? [duplicate]
My server has been timing out and crashing lately.
I ran this command:
netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
Check the picture for result. Does ...
3
votes
2
answers
3k
views
iftop Shows Lots of Mysterious Connections - Not Showing in netstat
I've just stopped all pretty much all services except sshd on my server (Ubuntu Server 10.04), and when I run iftop I get output that looks like this:
12.5Kb 25.0Kb ...
1
vote
1
answer
16k
views
DDOS Attack detection with netstat [duplicate]
I have a server, today load of my server over 20, i was found a command that detect alive connection to server for DDOS detection and reject IP.
netstat -anp | grep 'tcp\|udp' | awk '{print $5}' | ...
1
vote
2
answers
542
views
Difference between two netstat results for Apache
We are running RedHat Linux on two front end webservers both running Apache HTTP Server.
I have done a diff on both httpd.conf files and there are no differences but the server hostnames. We have ...
28
votes
5
answers
103k
views
Netstat continuous refresh (watch changes the output)
I am using this simple command to monitor connections (to deal with some recent DoS attacks) on my Debian server:
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
How do I ...
0
votes
1
answer
263
views
ss utility does't work properly
I've learned that ss, which is base on netlink, is much faster than netstat when amount of sockets is large. And the secret is here.
But when I tested on my suse linux minutes ago, the result ...
4
votes
2
answers
6k
views
How to know which process was using a port after it enters TIME_WAIT state?
On Linux, is there a way to figure out what process was using a port,
before it went into TIME_WAIT state.
When I use netstat -tnp I just see two end points, but no process information.
Proto Recv-Q ...
-1
votes
0
answers
262
views
netstat showing too many connections (Established) [duplicate]
Possible Duplicate:
Too Many ESTABLISHED connection from a single IP address in Apache
netstat -ntp |grep 80
shows too many ESTABLISHED connection from single IP address. Around 300 of them and ...
2
votes
3
answers
7k
views
Too Many ESTABLISHED connection from a single IP address in Apache
netstat -ntp |grep 80 shows too many ESTABLISHED connection from single IP address. Around 300 of them and it is not an attack and user is using a 2G connection to access Apache. This is the case ...
2
votes
3
answers
4k
views
Unexplicated ssh connection from localhost through sshd to random localhost's port
I've tried to find out why I had some strange connections on my secure log file. Something like this :
Apr 23 11:35:43 li192-61 sshd[11651]: Did not receive identification string from 127.0.0.1
Apr ...
1
vote
2
answers
7k
views
Why is the port listed only in the specific format of netstat?
I have Tomcat and I am trying to bind to 2 specific ports (using custom connectors). E.g. port A and port B.
Problem:
When I do netstat -a |grep A I do NOT see the port listed.
If I do netstat -antp I ...
0
votes
1
answer
1k
views
Very strange localhost connections on linux workstation. Need help identifiying the source
The following is the output of netstat on a Ubuntu machine. Can someone help decrypt the output? I am especially curious what the ::1:43213 connection is.
Also, why are there so many connections ...
1
vote
1
answer
2k
views
How to utilise netstat information
We have an application named "Seamer" installed on 2008R2 machine named "R2DUO" which has IP address set as 192.61.247.37 in host file and 172.26.127.40 is IP address of Ethernet card .We have two ...
0
votes
1
answer
1k
views
fast opening and closing connection with a specific port
We have a Main application named "Trevor" installed in 2008R2 machine named "TEAMER12" which is slow now. One more application named "TVS" also running in and found there were many connections per ...
7
votes
1
answer
9k
views
Port 80 being used by Microsoft-HTTPAPI/2.0
It's been quite a few days that port is being used by some strange process which i don't know Initially i thought it's related to SQL Server. I tried stopping all the services which starts from SQL :)....
1
vote
1
answer
1k
views
How to find malicious IPs?
Cacti shows irregular and pretty steady high bandwidth to my server (40x the normal) so I guess the server is udnder some sort of DDoS attack. The incoming bandwidth has not paralyzed my server, but ...
1
vote
1
answer
710
views
nginx serving .php as static files
ok, again apparently a totally ridiculous problem which I just can't seem to figure out.
nginx keeps serving my .php files as static files.
I've installed nginx via the repositories on ubuntu. I've ...
3
votes
3
answers
3k
views
python reports socket in use, netstat and others claim its not
We have a strange socket issue with a RHES3 box:
Python 2.4.1 (#1, Jul 5 2005, 19:17:11)
[GCC 3.2.3 20030502 (Red Hat Linux 3.2.3-52)]
Type "help", "copyright", "credits" or "license" for more ...
3
votes
2
answers
1k
views
Interpreting Netstat output
I have a LAMP stack running Fedora 12 and I am run the following instruction through the command line on the server:
netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | ...
1
vote
2
answers
724
views
How to measure bandwidth within the last 15 minutes?
I would like to log my bandwidth into a database and find out when my windows server 2003 is being used the most.
I want to feed the database with the bandwidth passed from the last feed (let's say it'...
2
votes
1
answer
6k
views
How to reset netstat -e counters
I would like to reset netstat -e counters.
How can I do it?
Renewing the network interface may reset these counters, but it is NOT an option - the networking must not be interrupted.
My OS is ...
0
votes
1
answer
261
views
size of packet icmp with netstat TX
I am confused with the size of packet icmp. I just did a simple initial netstat, where
for eth0 : TX-OK = 485
after 1 ping message is send, again I see in netstat TX-OK = 488
So, I just want to know ...
0
votes
2
answers
6k
views
restart counter in netstat
I am using Ubuntu.
I need to count the number of packet received in a specific interface. I found this can be done using netstat. However, I need to count starting from t=zero until a specific time I ...
2
votes
1
answer
5k
views
netstat -e: high discards and errors
I think my network is congested because of the relatively large discards and errors data. They should be zero or at least close to that.
Here is the output of netstat -e on my computer:
Interface ...
1
vote
1
answer
465
views
What's the difference between Send-Q and S-BCNT in FreeBSD netstat -anx?
What's the exact meaning of Send Buffer byte count in the extended netstat statistics, and why is it always bigger than Send-Q?
In other words, what's counted against the S-BCNT that's not counted ...