netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

0
votes
1answer
24 views

How to use non-deprecated tools like ss to get process id running on a port?

I am looking for a non-deprecated way of running a command like netstat -tulpn | grep 8000 to output information about an active port. Any suggestions on how to use a tool like ss to get the process ...
-1
votes
1answer
41 views

Too large 127.0.0.1 connections with nginx - apache2 [duplicate]

I use nginx as proxy-server apache2 and I have a problem with netstat output: $ netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n 5 109.195.36.169 6 109.195.33.205 8 ...
1
vote
1answer
2k views

UDP port appears to be in use but is not shown in netstat or TCPView

I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen ...
4
votes
2answers
1k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
-1
votes
1answer
43 views

Does “ESTABLISHED” state in netstat command for the sshd program mean they actually have access?

I have this person(or bot) from an IP in Chile which has an "ESTABLISHED" connection to SSHD as root on my server. I'm trying to understand what netstat's outputs really mean, the manual doesn't ...
1
vote
2answers
28 views

See stats of data in and out of each connection to a port

I have an application listening to a port. The clients connect to it using http connection. At any given time I see around 3000 connections established. I assume not all these connections are in use ...
0
votes
1answer
12 views

Concurrent connections per IP

I need to make a few changes to a firewall configuration, but before I do I'd like to see the number of concurrent Apache connections per IP. This command produces a nice list: #netstat -ntu | awk ...
0
votes
2answers
46 views

Print last column containing spaces and special characters

I need a full path/command thats been execued to start a process thats exposed on the network - listens on tcp/udp . I did manage to get all of that using below "one liner": netstat -nlp46|tail -n +3 ...
2
votes
1answer
821 views

iftop Shows Lots of Mysterious Connections - Not Showing in netstat

I've just stopped all pretty much all services except sshd on my server (Ubuntu Server 10.04), and when I run iftop I get output that looks like this: 12.5Kb 25.0Kb ...
2
votes
1answer
70 views

Is it normal to have many connections from my own server ip when I ran netstat command?

I would like to know if is it normal to have many connections from my own server ip when I ran: netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | ...
10
votes
7answers
32k views

How do I get rid of sockets in FIN_WAIT1 state?

I have a port that is blocked by a process I needed to kill. (a little telnet daemon that crashed). The process was killed successfully but the port is still in a 'FIN_WAIT1' state. It doesn't come ...
1
vote
0answers
41 views

Why is SQL Server using all ephemeral ports connecting to itself and causing TIME_WAITs?

I've got an AWS server with Windows 2008 R2, SQL Server 2012, and Tomcat 7. When I run netstat -ano the screen is flooded with TIME_WAIT. I posted the output in a Gist. When I run CurrPorts, filter ...
1
vote
0answers
91 views

TCP High Send-q coupled with FIN_WAIT1 status

I'm having a problem with one of my webservers, which is taking minutes to completely render a web page. I had a look at the TCP connection and noticed that I have a very high value in the send-q ...
0
votes
0answers
62 views

No connection available in pool. netstat RecvQ shows high number

In our servers there is one particular dependency (java jar), which makes a total of 1024 connection to various remote servers (the library works as a service discovery). Intermittently, it is ...
0
votes
1answer
274 views

Nginx not running with no error message (ubuntu 14.04 lts)

I am trying to start my nginx server. When I type "$> /etc/init.d/nginx start", I have a message appearing "Starting nginx: Ok", and then nothing happens. When I type "sudo lsof -nP -i | grep ...
4
votes
2answers
311 views

How to make netstat on Linux only show OUTBOUND tcp connections?

My ubuntu server is infected and there is a process making a bunch of HTTP requests to a bunch of websites (sucks!). I have added the following to my firewall (UFW): sudo ufw deny out proto tcp to ...
0
votes
0answers
24 views

netstat output without PID

I just stumbled across this issue with the netstat output on my server, There are a couple of ports which are listening, but do not have a PID attached to it. I want to make sure they are not ...
1
vote
1answer
130 views

Port suddenly closed. How to re-open?

I've written a software module in PHP that manages the saving of data in different data stores (MySQL, ElasticSearch and Redis). To test the module, I've created several test plans in Apache JMeter, ...
2
votes
2answers
92 views

Limit to number of listening ports in linux

I have tried to launch a script to listen to thousands of tcp ports (1000 to 10000) but it appears to be hitting a limit of 1024 listening ports. I've confirmed this via netstat and closed ports above ...
1
vote
0answers
27 views

How to check a given connection has been offloaded to network card

From what I read, some part of the tcp protocol operation can be offloaded from kernel to network card driver thanks to TOE (or GSO, LSO, LRO..). My objective is too find if a given socket has some ...
0
votes
4answers
8k views

netstat shows many times deploy.akamaitechnologies.com connected to my server

Many times, after running netstat on my server, I find one of IP addresses belonging to deploy.akamaitechnologies.com connected to my server, do someone has an idea on what is happening on my server ? ...
0
votes
1answer
48 views

Simulation of TX/RX Drop

I'm trying to get the "TX/RX Drop" values to increase. I've tried dropping packets using both iperf and iptables but the statistics aren't increasing even when packets are being dropped. Is there a ...
1
vote
0answers
53 views

iptables traffic after forwarding

I have 2 servers Server A and Server B ServerA = 1.1.1.1 ServerB = 2.2.2.2 I am using ip-tables to send all traffic on port 80 to Server B on Server (A) 1.1.1.1 i have done iptables -t nat -A ...
0
votes
0answers
51 views

Ghost tcp connections: ss sees them, nothing else does

We have a strange problem. Our remote server shows over 900 connections coming from our office over port 80: # ss -n | grep ESTAB | grep $OFFICEIP | grep :80 | wc -l 935 Netstat shows a similar ...
0
votes
2answers
545 views

Netstat count TIME_WAIT connections by port

I can obtain individual TIME_WAIT counts on a port, netstat -nat | grep :11300 | grep TIME_WAIT | wc -l; but how to do this based on all ports eg: 11300 2900 connection 3306 1200 connection ...
0
votes
2answers
102 views

Display IP & TCP statistics per interface (netstat -s with interface)

Linux has the ability to display protocol statistics with netstat -s. The output looks something like: Excerpt: 7487 times unabled to send RST due to no memory TCPDSACKIgnoredOld: 817 ...
1
vote
1answer
131 views

Limit Number of TCP connections in Linux Server, to avoid attack

I want to limit the number of TCP connections in Linux server, I have used the following command. iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 25 --connlimit-mask 32 ...
0
votes
2answers
2k views

How does netstat get a hostname from IP while nslookup & nblookup fail every time?

In Windows Server 2003, when I run netstat with no flags, it takes much longer than netstat -n to return results. I realize this is because it has to perform reverse lookups by IP address to get the ...
1
vote
4answers
257 views

Is there a netstat -s equivalent for windows?

I know that netstat -s exists on Windows, but it displays way less informations than on Linux/OS X. It only gives 8 counters about TCP, while on Linux it's more than 50. I'm looking for any ...
0
votes
1answer
88 views

Port 80 doesn't work

I have a website in my ubuntu server 14.04, with apache2 server, and untils fews days go the site works fine but, today if I digit www.mydomain.com from my internal network it works but, if I try with ...
1
vote
5answers
180 views

Get number of TCP established connections

On a Linux server one can use netstat -tan | grep ESTABLISHED| wc -l but this will not work on a high load server with watch -n1. Such approach works fine if the server is not very busy or the ...
0
votes
1answer
156 views

What causes “SYN to LISTEN sockets dropped”?

A quite busy proxy server has lots of "SYNs to LISTEN sockets dropped". I learned one cause could be a too small backlog size. But in that case the "times the listen queue of a socket overflowed" ...
0
votes
0answers
63 views

xinetd stops working in Debian Wheezy

We have a server with a whois service running. The whois service is provided by xinetd. The configuration file /etc/xinetd.d/whois looks like this: service whois { socket_type = stream ...
18
votes
5answers
18k views

How to find other end of unix socket connection?

I have a process (dbus-daemon) which has many open connection over UNIX sockets. One of these connections is fd #36: =$ ps uw -p 23284 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME ...
3
votes
1answer
93 views

What does it mean for netstat -t

I see the help of netstat -t option says Displays the current connection offload state. And I tried it in the windows command console. The Offload State value display InHost. What does Offload ...
9
votes
6answers
9k views

netstat shows a listening port with no pid but lsof does not

This question is similar to Network port open, but no process attached? I've tried everything from there, reviewed the logs, etc... and can't find anything. My netstat shows a TCP listening port and ...
0
votes
1answer
179 views

Netstat - Thunderbird and others work on strange ports

I'm getting this: $ sudo netstat -alpv tcp 0 0 comp.local:35409 ey-in-f16.1e100.n:imaps ESTABLISHED 2782/thunderbird-bi tcp 0 0 comp.local:52950 ...
82
votes
4answers
89k views

What's the difference between ip address 0.0.0.0 and 127.0.0.1?

I do know that 127.0.0.1 ~ 127.255.255.254 are the loopback IP addresses for most modern operating systems and we could use these IP addresses to refer to our own computer. But what's 0.0.0.0? It ...
0
votes
0answers
86 views

netstat e on windows shows really high bytes count

running netstat /e is giving me strange results "bytes received" from netstat /e output is always way higher, about 10 times higher than when netsh interface ip show subinterfaces is run. wireshark ...
1
vote
2answers
88 views

Difference Between Netstat and Access Log

When I was checking stats in SSH terminal for my VPS, I noticed that netstat and access log gives different results. When I used: netstat -anp I saw that one attacker having 32 concurrent ...
0
votes
0answers
2k views

Windows TCP Port 139 Netbios-ssn vulnerability

I ran netstat -b on my computer. Two results showed that I do not understand, VAIO being another PC on the LAN. [firefox.exe] TCP 192.168.100.106:49186 VAIO:netbios-ssn TIME_WAIT TCP ...
0
votes
1answer
65 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk ...
1
vote
1answer
983 views

How to reset netstat -e counters

I would like to reset netstat -e counters. How can I do it? Renewing the network interface may reset these counters, but it is NOT an option - the networking must not be interrupted. My OS is ...
4
votes
7answers
23k views

Port 80 is being used by SYSTEM (PID 4), what is that?

I am trying to use port 80 for my application server, but when I perform "netstat -aon" I get TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 When I look up the process in ...
1
vote
2answers
109 views

How to find the count of Apache workers' at a given point for shared IPs?

One can find the number of Apache workers an IP address is consuming at an instantaneous point in time by executing: netstat -pantu | grep :80 |sort | uniq -c |grep <IP_HERE, eg: 192.168> | wc ...
3
votes
2answers
226 views

After kill -9 process won't disappear and port is still bound

We have a Java server application running on Mac OS X. Occasionally this application has become unresponsive, and we have resorted to killing it with kill -9. However, the process doesn't disappear; ...
6
votes
4answers
13k views

Running lsof -i shows a lot of connections in CLOSE_WAIT ? Should I worry

So I am running lsof -i | wc -l periodically and it is telling me that out of 420 lines, between 240 and 255 are in CLOSE_WAIT state. How does TCP connections enter this state ? Should I be worried ...
0
votes
2answers
317 views

What are records in 'netstat' command are when using logstash?

I use logstash with embedded elasticsearch. My logstash config looks like the following: output { tdout { debug => true debug_format => "json"} elasticsearch { embedded => true ...
1
vote
2answers
202 views

Can I find the list of ports being listened by a process ordered by the time of opening?

I know I can see the list of open ports using the lsof command. I am trying to view the results ordered by timestamp of listening. The process opens multiple (~6) ports and I suspect the order of ...
-3
votes
2answers
58 views

How to get the number of current connections to an external web service [closed]

My application makes many requests in a day to a webservice (say 172.20.20.20:11111) on a different server. I would like to know how I can count the number of connections that are established (the ...