netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

8
votes
2answers
1k views

Where are my TIME_WAITs on Mac OS X?

No TIME_WAITs on Mac OS X Normally, when a TCP connection is closed, the socket on the side where close() is called first is left in the TIME_WAIT state. When one of the peers is a Mac OS X (Lion) ...
1
vote
1answer
1k views

netstat -e: high discards and errors

I think my network is congested because of the relatively large discards and errors data. They should be zero or at least close to that. Here is the output of netstat -e on my computer: Interface ...
3
votes
2answers
4k views

UDP port appears to be in use but is not shown in netstat or TCPView

I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen ...
0
votes
2answers
27 views

Port Scanning Large Sets of Targets

1)How would you check to see if a list of ~10000 IPs if they have port 80 open? 2)How would you go about the same scenario but with a port range? 3)How would you check a list of 10000 IPs to see ...
5
votes
3answers
3k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
0
votes
0answers
27 views

Can't bind UDP socket but port is free

I've been struggling for a while now with this so maybe someone here is able to help me. I'm setting up a CS:GO server that's going to be running on port 27059. (This is a copy&paste from a ...
0
votes
2answers
2k views

Netstat count TIME_WAIT connections by port

I can obtain individual TIME_WAIT counts on a port, netstat -nat | grep :11300 | grep TIME_WAIT | wc -l; but how to do this based on all ports eg: 11300 2900 connection 3306 1200 connection ...
0
votes
0answers
30 views

IIS6 - localhost/MachineName IP/Ports configuration Error after system crash and Restore

Six months ago my hosted win 2003 server crashed due to RAID drive issues while at the datacentre and I lost my installation. After a re-install I recovered my websites, (with help .. approx. 10) and ...
0
votes
1answer
46 views

Irresponsive nginx while doing “nginx reload”

While reloading nginx, I started getting errors in messages log "possible SYN flooding on port 443", and it seems like nginx becomes completely irresponsive at that time (quite for a while), cause ...
1
vote
0answers
26 views

Why netstat -p doesn't show PID of established connections?

I have some REST service which is listening on tcp/8051 I'm querying this service with curl in infinite loop from the same host: while true; do curl --header "Authorization: Bearer ...
0
votes
0answers
13 views

netstats shows my own server is hitting a server its not supposed to know about

ON AWS I have a few dedicated servers that do image processing and they seem to get high traffic and fail. when running netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n I ...
0
votes
0answers
36 views

netstat result showing syn sent for specific ip (local) which is not exist in LAN

I was using my web server (jboss) in different subnet (192.168.150.10/24) and after sometime, just changed to another subnet (192.168.200.20/24). But still i could see in netstat -pnt result, my new ...
0
votes
1answer
54 views

Check number of connections to webserver port 80 AND 443

As the title says how would one check the number of open connections to a webserver on port 80 and 443? I'm currently using this oneliner to get the number of open connections per ipaddress from port ...
8
votes
4answers
21k views

netstat -ntap doesn't show pid/process name for some connections?

I have ubuntu/hardy server, with kernel 2.6.24-23-server and netstat: # netstat --version net-tools 1.60 netstat 1.42 (2001-04-15) The problem is that we have a lot of ESTABLISHED connections that ...
0
votes
1answer
19 views

PID 4 Using Port 80 - IIS Unable To Bind

So I've been having a problem where I can't use localhost:80 on IIS So I ran this: > netstat -ano | find "0:80" And got: TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 ...
0
votes
0answers
183 views

IPA Server installation: Error with port number

When I am trying to install IPA server, I am getting the following error : IPA requires port 8443 for PKI but it is currently in use. Aborting installation I checked with netstat -tuplen | grep ...
4
votes
8answers
33k views

Port 80 is being used by SYSTEM (PID 4), what is that?

I am trying to use port 80 for my application server, but when I perform "netstat -aon" I get TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 When I look up the process in ...
1
vote
0answers
30 views

How to aggregate reports given by nestat?

In this question OP gives some reports that has been generated with netstat. However, the more I look at the switches of netstat, the less I can find how to generate that report. The sample report is:...
2
votes
2answers
1k views

iftop Shows Lots of Mysterious Connections - Not Showing in netstat

I've just stopped all pretty much all services except sshd on my server (Ubuntu Server 10.04), and when I run iftop I get output that looks like this: 12.5Kb 25.0Kb ...
1
vote
1answer
177 views

Why does this “netstat -tln” output show entries for “0.0.0.0:22” and “127.0.0.1:3306” [closed]

When I run the command netstat -tln I see the following output: Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 ...
10
votes
3answers
5k views

In the output for netstat what does the [::] mean?

In the results for netstat what does the [::] mean? example [::]:ssh [::]:* LISTEN
3
votes
2answers
12k views

Netstat continuous refresh (watch changes the output)

I am using this simple command to monitor connections (to deal with some recent DOS attacks) on my Debian server: netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n How do I ...
0
votes
0answers
458 views

Weird CLOSE_WAIT statuses at standard PHP application

I am asking for help regarding tcp problems on a webserver serving a web application built in PHP. The client is a standard html/js page viewed in the web browser. This client sends Ajax requests ...
1
vote
3answers
921 views

netstat doesn't display full remote ip address, no ip address for ssl, port 443

We're running a Apache webserver on Arch Linux (build from May '10) and while monitoring connections with netstat we're seeing some odd connections on port 443 that don't report an IP address; is this ...
0
votes
1answer
33 views

How to find webserver running on server and find why do some web apps respond and some don't?

I didn't configure this server so I don't know what is running or where things are running. The server is some sort of rack server (1U or 2U Dell running in our datacenter) running Centos. So we ...
2
votes
0answers
281 views

How to resolve UDP packets being dropped given netstat reporting SndbufErrors

I have a server instance on an OpenStack that at a pretty high load starts loosing UDP packets. I captured all outgoing packets using tcpdump and some of them are missing, even though application logs ...
25
votes
6answers
31k views

How to find other end of unix socket connection?

I have a process (dbus-daemon) which has many open connection over UNIX sockets. One of these connections is fd #36: =$ ps uw -p 23284 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME ...
0
votes
3answers
287 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk '{...
0
votes
0answers
58 views

What does `SYNs to LISTEN sockets dropped` from `netstat -s` mean

I could found 437 SYNs to LISTEN sockets dropped from netstat -s from the server on my server which runs nginx. I found this explanation from the man page: --statistics, -s, Display summary ...
1
vote
1answer
137 views

HTTPD listening in IPv6, according netstat, but reacheable in IPv4

Using Openstack, I have a Web GUI (horizon) hosted on my server (HTTPS). When I do a netstat -lt | grep https, I have: tcp6 0 0 [::]:https [::]:* LISTEN ...
0
votes
0answers
17 views

Ubuntu/Apache2 - Virtual host stops my MySQL server [duplicate]

I have really strange problem. I have an Apache2 server on Ubuntu 14.04 with installed MySQL server. Everything was working fine. I have multiple domains hosted on one server and i believe i received ...
-1
votes
1answer
59 views

Why when i use netstat while not connected to internet, it returns some ip addresses?

I read that this command displays network connections for the Transmission Control Protocol more info link netstat ,but when i not connected to internet and i turn off XAMMP server,it returns some ...
1
vote
0answers
162 views

How to diagnose netstat: no namelist

I had to replace an NIC on my HP Proliant Microserver, running FreeNAS 9.3 In my crashplan jail, I now get "netstat: no namelist" as a response when I execute the netstat command. How to I diagnose ...
0
votes
1answer
35 views

Netcat - socket in time_wait when echoing and piping, but not when invoked directly

I'm testing an application using netcat (nc) and I'm getting very low throughput on network connections. When I ran netstat -tnpo I see numerous TCP sessions in TIME_WAIT. I'm sending data to my ...
0
votes
1answer
70 views

nmap shows strange open ports

Running nmap on my localhost shows me strange open ports: $ nmap -p- localhost Starting Nmap 6.47 ( http://nmap.org ) at 2015-12-28 12:14 CET Nmap scan report for localhost (127.0.0.1) Host is up (0....
0
votes
0answers
968 views

Synology open for Cloud Station even if blocking 6690 port

I have a NAS Synology beyong my Internet Box. On the Internet Box, I have UPnP not activated and I have only activated on Port Transfer the following ports : 1701/UDP, 500/UDP and 4500/UDP which are ...
0
votes
2answers
114 views

Matching an IP address to a hostname when both are available but cannot be resolved

I am an administrator on a server that accepts RDP connections. When the client connects I know the client's computer name. Using netstat I can determine which connections have been established for ...
0
votes
1answer
53 views

How to Terminate specific TCP sessions without tcpkill

I found lot of TCP connections(listed through netstat) from my Linux server to windows server. I want to kill those sessions without tcpkill cmd how can I ? Please advise ..
2
votes
2answers
472 views

Is it normal to have many connections from my own server ip when I ran netstat command?

I would like to know if is it normal to have many connections from my own server ip when I ran: netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | ...
0
votes
0answers
23 views

netstat -r on debian give abnormal output

after looking for stuff with Debian "netstat" and try list stuff with "nestat -r" my main Server out a Long list of unkown Hosts ( mostly hacked IP´s by looking on abuseDB ) here a small example for ...
0
votes
1answer
1k views

How to check if sockets are sending/receiving data on linux?

I often have to debug processes which involve a server client tcp connection. I'd like to check, during times where a client might seem stuck, whether the server is sending it data or not. I can use: ...
0
votes
0answers
51 views

Monitor outgoing web traffic sources on CentOS [duplicate]

I received a report today that a server I manage (Centos + Apache) is launching a bruteforce attack against wordpress websites: hacked-joomla/brobot The requests sent look like this: x.x.x.x - - [...
2
votes
0answers
63 views

cannot bind a port altough LISTEN

I'm new to this problem I'm using Ubuntu 12.04 LTS via VMware My problem is to bind port 6703 i tried alot of commands to check if this port or open or not Error Message is Failed to bind to: 0....
1
vote
0answers
24 views

How do you write the following command : if (netstat flag ==UG ) save addres IP [closed]

how How do you write the following command in ubuntu : if (netstat flag ==UG ) thene addres ip > new file I want to file contains : addres ip 152.123.12.1 123.12.12.123 ....
0
votes
0answers
24 views

CentOS 6.6 rogue mail process? Server sending spam [duplicate]

Our server has been recently compromised and was sending spam emails. We've found the php scripts responsible, eliminated them, and updated the postfix configuration. Problem is that when we ran the ...
2
votes
2answers
335 views

lsof doesn't show the established TCP connection

On my system, if I run the netstat for a port, it returns: $ netstat -nat | grep "60964" tcp 0 0 192.0.0.1:60964 0.0.0.0:* LISTEN tcp 59 0 192.0.0....
-1
votes
2answers
213 views

netstat on unix server shows strange connections

netstat is showing a lot of unknown connections from different strange places. are they just attempt to establish connection? or is my server compromised? I've removed my local addresses from the log ...
13
votes
8answers
43k views

How do I get rid of sockets in FIN_WAIT1 state?

I have a port that is blocked by a process I needed to kill. (a little telnet daemon that crashed). The process was killed successfully but the port is still in a 'FIN_WAIT1' state. It doesn't come ...
0
votes
5answers
14k views

netstat shows many times deploy.akamaitechnologies.com connected to my server

Many times, after running netstat on my server, I find one of IP addresses belonging to deploy.akamaitechnologies.com connected to my server, do someone has an idea on what is happening on my server ? ...
0
votes
2answers
3k views

Nginx not running with no error message (ubuntu 14.04 lts)

I am trying to start my nginx server. When I type "$> /etc/init.d/nginx start", I have a message appearing "Starting nginx: Ok", and then nothing happens. When I type "sudo lsof -nP -i | grep LISTEN"...