netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

0
votes
2answers
2k views

Netstat count TIME_WAIT connections by port

I can obtain individual TIME_WAIT counts on a port, netstat -nat | grep :11300 | grep TIME_WAIT | wc -l; but how to do this based on all ports eg: 11300 2900 connection 3306 1200 connection ...
0
votes
1answer
25 views

Port Scanning Large Sets of Targets

1)How would you check to see if a list of ~10000 IPs if they have port 80 open? 2)How would you go about the same scenario but with a port range? 3)How would you check a list of 10000 IPs to see ...
0
votes
1answer
5 views

PID 4 Using Port 80 - IIS Unable To Bind

So I've been having a problem where I can't use localhost:80 on IIS So I ran this: > netstat -ano | find "0:80" And got: TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 ...
0
votes
0answers
150 views

IPA Server installation: Error with port number

When I am trying to install IPA server, I am getting the following error : IPA requires port 8443 for PKI but it is currently in use. Aborting installation I checked with netstat -tuplen | grep ...
4
votes
8answers
32k views

Port 80 is being used by SYSTEM (PID 4), what is that?

I am trying to use port 80 for my application server, but when I perform "netstat -aon" I get TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 When I look up the process in ...
1
vote
1answer
1k views

netstat -e: high discards and errors

I think my network is congested because of the relatively large discards and errors data. They should be zero or at least close to that. Here is the output of netstat -e on my computer: Interface ...
7
votes
2answers
1k views

Where are my TIME_WAITs on Mac OS X?

No TIME_WAITs on Mac OS X Normally, when a TCP connection is closed, the socket on the side where close() is called first is left in the TIME_WAIT state. When one of the peers is a Mac OS X (Lion) ...
3
votes
2answers
4k views

UDP port appears to be in use but is not shown in netstat or TCPView

I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen ...
5
votes
3answers
3k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
1
vote
0answers
16 views

How to aggregate reports given by nestat?

In this question OP gives some reports that has been generated with netstat. However, the more I look at the switches of netstat, the less I can find how to generate that report. The sample report ...
2
votes
2answers
1k views

iftop Shows Lots of Mysterious Connections - Not Showing in netstat

I've just stopped all pretty much all services except sshd on my server (Ubuntu Server 10.04), and when I run iftop I get output that looks like this: 12.5Kb 25.0Kb ...
1
vote
1answer
124 views

Why does this “netstat -tln” output show entries for “0.0.0.0:22” and “127.0.0.1:3306” [closed]

When I run the command netstat -tln I see the following output: Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 ...
10
votes
3answers
5k views

In the output for netstat what does the [::] mean?

In the results for netstat what does the [::] mean? example [::]:ssh [::]:* LISTEN
3
votes
2answers
11k views

Netstat continuous refresh (watch changes the output)

I am using this simple command to monitor connections (to deal with some recent DOS attacks) on my Debian server: netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n How do I ...
0
votes
0answers
325 views

Weird CLOSE_WAIT statuses at standard PHP application

I am asking for help regarding tcp problems on a webserver serving a web application built in PHP. The client is a standard html/js page viewed in the web browser. This client sends Ajax requests ...
1
vote
3answers
906 views

netstat doesn't display full remote ip address, no ip address for ssl, port 443

We're running a Apache webserver on Arch Linux (build from May '10) and while monitoring connections with netstat we're seeing some odd connections on port 443 that don't report an IP address; is this ...
0
votes
1answer
29 views

How to find webserver running on server and find why do some web apps respond and some don't?

I didn't configure this server so I don't know what is running or where things are running. The server is some sort of rack server (1U or 2U Dell running in our datacenter) running Centos. So we ...
2
votes
0answers
177 views

How to resolve UDP packets being dropped given netstat reporting SndbufErrors

I have a server instance on an OpenStack that at a pretty high load starts loosing UDP packets. I captured all outgoing packets using tcpdump and some of them are missing, even though application logs ...
24
votes
6answers
29k views

How to find other end of unix socket connection?

I have a process (dbus-daemon) which has many open connection over UNIX sockets. One of these connections is fd #36: =$ ps uw -p 23284 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME ...
0
votes
3answers
265 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk ...
0
votes
0answers
42 views

What does `SYNs to LISTEN sockets dropped` from `netstat -s` mean

I could found 437 SYNs to LISTEN sockets dropped from netstat -s from the server on my server which runs nginx. I found this explanation from the man page: --statistics, -s, Display summary ...
1
vote
1answer
93 views

HTTPD listening in IPv6, according netstat, but reacheable in IPv4

Using Openstack, I have a Web GUI (horizon) hosted on my server (HTTPS). When I do a netstat -lt | grep https, I have: tcp6 0 0 [::]:https [::]:* LISTEN ...
0
votes
0answers
17 views

Ubuntu/Apache2 - Virtual host stops my MySQL server [duplicate]

I have really strange problem. I have an Apache2 server on Ubuntu 14.04 with installed MySQL server. Everything was working fine. I have multiple domains hosted on one server and i believe i received ...
-1
votes
1answer
51 views

Why when i use netstat while not connected to internet, it returns some ip addresses?

I read that this command displays network connections for the Transmission Control Protocol more info link netstat ,but when i not connected to internet and i turn off XAMMP server,it returns some ...
1
vote
0answers
110 views

How to diagnose netstat: no namelist

I had to replace an NIC on my HP Proliant Microserver, running FreeNAS 9.3 In my crashplan jail, I now get "netstat: no namelist" as a response when I execute the netstat command. How to I diagnose ...
0
votes
1answer
33 views

Netcat - socket in time_wait when echoing and piping, but not when invoked directly

I'm testing an application using netcat (nc) and I'm getting very low throughput on network connections. When I ran netstat -tnpo I see numerous TCP sessions in TIME_WAIT. I'm sending data to my ...
0
votes
1answer
60 views

nmap shows strange open ports

Running nmap on my localhost shows me strange open ports: $ nmap -p- localhost Starting Nmap 6.47 ( http://nmap.org ) at 2015-12-28 12:14 CET Nmap scan report for localhost (127.0.0.1) Host is up ...
0
votes
0answers
825 views

Synology open for Cloud Station even if blocking 6690 port

I have a NAS Synology beyong my Internet Box. On the Internet Box, I have UPnP not activated and I have only activated on Port Transfer the following ports : 1701/UDP, 500/UDP and 4500/UDP which are ...
0
votes
2answers
95 views

Matching an IP address to a hostname when both are available but cannot be resolved

I am an administrator on a server that accepts RDP connections. When the client connects I know the client's computer name. Using netstat I can determine which connections have been established for ...
0
votes
1answer
46 views

How to Terminate specific TCP sessions without tcpkill

I found lot of TCP connections(listed through netstat) from my Linux server to windows server. I want to kill those sessions without tcpkill cmd how can I ? Please advise ..
2
votes
2answers
411 views

Is it normal to have many connections from my own server ip when I ran netstat command?

I would like to know if is it normal to have many connections from my own server ip when I ran: netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | ...
0
votes
0answers
23 views

netstat -r on debian give abnormal output

after looking for stuff with Debian "netstat" and try list stuff with "nestat -r" my main Server out a Long list of unkown Hosts ( mostly hacked IP´s by looking on abuseDB ) here a small example for ...
0
votes
1answer
1k views

How to check if sockets are sending/receiving data on linux?

I often have to debug processes which involve a server client tcp connection. I'd like to check, during times where a client might seem stuck, whether the server is sending it data or not. I can use: ...
0
votes
0answers
51 views

Monitor outgoing web traffic sources on CentOS [duplicate]

I received a report today that a server I manage (Centos + Apache) is launching a bruteforce attack against wordpress websites: hacked-joomla/brobot The requests sent look like this: x.x.x.x - - ...
2
votes
0answers
52 views

cannot bind a port altough LISTEN

I'm new to this problem I'm using Ubuntu 12.04 LTS via VMware My problem is to bind port 6703 i tried alot of commands to check if this port or open or not Error Message is Failed to bind to: ...
1
vote
0answers
24 views

How do you write the following command : if (netstat flag ==UG ) save addres IP [closed]

how How do you write the following command in ubuntu : if (netstat flag ==UG ) thene addres ip > new file I want to file contains : addres ip 152.123.12.1 123.12.12.123 ...
0
votes
0answers
24 views

CentOS 6.6 rogue mail process? Server sending spam [duplicate]

Our server has been recently compromised and was sending spam emails. We've found the php scripts responsible, eliminated them, and updated the postfix configuration. Problem is that when we ran the ...
2
votes
2answers
311 views

lsof doesn't show the established TCP connection

On my system, if I run the netstat for a port, it returns: $ netstat -nat | grep "60964" tcp 0 0 192.0.0.1:60964 0.0.0.0:* LISTEN tcp 59 0 ...
-1
votes
2answers
192 views

netstat on unix server shows strange connections

netstat is showing a lot of unknown connections from different strange places. are they just attempt to establish connection? or is my server compromised? I've removed my local addresses from the log ...
13
votes
8answers
42k views

How do I get rid of sockets in FIN_WAIT1 state?

I have a port that is blocked by a process I needed to kill. (a little telnet daemon that crashed). The process was killed successfully but the port is still in a 'FIN_WAIT1' state. It doesn't come ...
0
votes
5answers
13k views

netstat shows many times deploy.akamaitechnologies.com connected to my server

Many times, after running netstat on my server, I find one of IP addresses belonging to deploy.akamaitechnologies.com connected to my server, do someone has an idea on what is happening on my server ? ...
0
votes
2answers
2k views

Nginx not running with no error message (ubuntu 14.04 lts)

I am trying to start my nginx server. When I type "$> /etc/init.d/nginx start", I have a message appearing "Starting nginx: Ok", and then nothing happens. When I type "sudo lsof -nP -i | grep ...
2
votes
1answer
36 views

iptable block outbound traffic for which binary?

Presently iptables is blocking all outbound traffic except for a few known/approved services. iptables logs a sample of each time it blocks (2/min), I am trying to figure out what is making the ...
1
vote
1answer
221 views

Netstat showing multiple connections for on ssh login

I connect to my server via ssh. I am the only person who has access to connect to the server. After connecting via ssh, I run the following command: sudo netstat -tupn The output includes the ...
1
vote
3answers
353 views

Is postfix the only program that should be using port 25

My server IP was blacklisted for sending out spam and I am tracking down the program sending spam. I did netstat, and it shows a lot of programs using port 25 e.g tcp 0 182 ...
1
vote
1answer
786 views

High count packets rejects in established connections because of timestamp

I am trying to set up a Wowza media server using a Dell R710 with 24GB memory and a 10Gbit connection and all the calculations say it should be able to handle around 20k connections however when I get ...
1
vote
0answers
72 views

What exactly constitutes a bad TCP segment?

What constitutes a bad segment as in bad segments received in the netstat output below? I would think a TCP header's checksum could do it, but are there other things? If a segment arrives after its ...
2
votes
1answer
56 views

Is it possible to deterministically trace how port 80 is forwarded and where the configuration is on a given system?

Is there a way to determine or trace how a port forwarding configuration is set up on a system running Ubuntu 14.04 LTS, on which there is a NodeJS service running and somehow accepting connections ...
2
votes
1answer
47 views

Does the netstat counter wrap around? And over what period are they collected?

If I run netstat -s on my solaris 10 box, I got a lot of network statistics. Are these counters since the time of system boot, or some other arbitrary period? And some of the numbers are quite ...
138
votes
4answers
138k views

What's the difference between ip address 0.0.0.0 and 127.0.0.1?

I do know that 127.0.0.1 ~ 127.255.255.254 are the loopback IP addresses for most modern operating systems and we could use these IP addresses to refer to our own computer. But what's 0.0.0.0? It ...