netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

0
votes
0answers
11 views

No connection available in pool. netstat RecvQ shows high number

In our servers there is one particular dependency (java jar), which makes a total of 1024 connection to various remote servers (the library works as a service discovery). Intermittently, it is ...
10
votes
7answers
30k views

How do I get rid of sockets in FIN_WAIT1 state?

I have a port that is blocked by a process I needed to kill. (a little telnet daemon that crashed). The process was killed successfully but the port is still in a 'FIN_WAIT1' state. It doesn't come ...
0
votes
1answer
29 views

Nginx not running with no error message (ubuntu 14.04 lts)

I am trying to start my nginx server. When I type "$> /etc/init.d/nginx start", I have a message appearing "Starting nginx: Ok", and then nothing happens. When I type "sudo lsof -nP -i | grep ...
3
votes
2answers
136 views

How to make netstat on Linux only show OUTBOUND tcp connections?

My ubuntu server is infected and there is a process making a bunch of HTTP requests to a bunch of websites (sucks!). I have added the following to my firewall (UFW): sudo ufw deny out proto tcp to ...
1
vote
1answer
1k views

UDP port appears to be in use but is not shown in netstat or TCPView

I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen ...
0
votes
0answers
15 views

netstat output without PID

I just stumbled across this issue with the netstat output on my server, There are a couple of ports which are listening, but do not have a PID attached to it. I want to make sure they are not ...
1
vote
1answer
54 views

Port suddenly closed. How to re-open?

I've written a software module in PHP that manages the saving of data in different data stores (MySQL, ElasticSearch and Redis). To test the module, I've created several test plans in Apache JMeter, ...
2
votes
2answers
71 views

Limit to number of listening ports in linux

I have tried to launch a script to listen to thousands of tcp ports (1000 to 10000) but it appears to be hitting a limit of 1024 listening ports. I've confirmed this via netstat and closed ports above ...
0
votes
0answers
15 views

How to check a given connection has been offloaded to network card

From what I read, some part of the tcp protocol operation can be offloaded from kernel to network card driver thanks to TOE (or GSO, LSO, LRO..). My objective is too find if a given socket has some ...
0
votes
4answers
7k views

netstat shows many times deploy.akamaitechnologies.com connected to my server

Many times, after running netstat on my server, I find one of IP addresses belonging to deploy.akamaitechnologies.com connected to my server, do someone has an idea on what is happening on my server ? ...
4
votes
2answers
1k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
0
votes
1answer
29 views

Simulation of TX/RX Drop

I'm trying to get the "TX/RX Drop" values to increase. I've tried dropping packets using both iperf and iptables but the statistics aren't increasing even when packets are being dropped. Is there a ...
1
vote
0answers
25 views

iptables traffic after forwarding

I have 2 servers Server A and Server B ServerA = 1.1.1.1 ServerB = 2.2.2.2 I am using ip-tables to send all traffic on port 80 to Server B on Server (A) 1.1.1.1 i have done iptables -t nat -A ...
0
votes
0answers
26 views

Ghost tcp connections: ss sees them, nothing else does

We have a strange problem. Our remote server shows over 900 connections coming from our office over port 80: # ss -n | grep ESTAB | grep $OFFICEIP | grep :80 | wc -l 935 Netstat shows a similar ...
0
votes
2answers
376 views

Netstat count TIME_WAIT connections by port

I can obtain individual TIME_WAIT counts on a port, netstat -nat | grep :11300 | grep TIME_WAIT | wc -l; but how to do this based on all ports eg: 11300 2900 connection 3306 1200 connection ...
0
votes
2answers
68 views

Display IP & TCP statistics per interface (netstat -s with interface)

Linux has the ability to display protocol statistics with netstat -s. The output looks something like: Excerpt: 7487 times unabled to send RST due to no memory TCPDSACKIgnoredOld: 817 ...
1
vote
1answer
95 views

Limit Number of TCP connections in Linux Server, to avoid attack

I want to limit the number of TCP connections in Linux server, I have used the following command. iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 25 --connlimit-mask 32 ...
0
votes
2answers
1k views

How does netstat get a hostname from IP while nslookup & nblookup fail every time?

In Windows Server 2003, when I run netstat with no flags, it takes much longer than netstat -n to return results. I realize this is because it has to perform reverse lookups by IP address to get the ...
1
vote
4answers
225 views

Is there a netstat -s equivalent for windows?

I know that netstat -s exists on Windows, but it displays way less informations than on Linux/OS X. It only gives 8 counters about TCP, while on Linux it's more than 50. I'm looking for any ...
0
votes
1answer
71 views

Port 80 doesn't work

I have a website in my ubuntu server 14.04, with apache2 server, and untils fews days go the site works fine but, today if I digit www.mydomain.com from my internal network it works but, if I try with ...
1
vote
5answers
106 views

Get number of TCP established connections

On a Linux server one can use netstat -tan | grep ESTABLISHED| wc -l but this will not work on a high load server with watch -n1. Such approach works fine if the server is not very busy or the ...
0
votes
1answer
76 views

What causes “SYN to LISTEN sockets dropped”?

A quite busy proxy server has lots of "SYNs to LISTEN sockets dropped". I learned one cause could be a too small backlog size. But in that case the "times the listen queue of a socket overflowed" ...
0
votes
0answers
40 views

xinetd stops working in Debian Wheezy

We have a server with a whois service running. The whois service is provided by xinetd. The configuration file /etc/xinetd.d/whois looks like this: service whois { socket_type = stream ...
17
votes
5answers
16k views

How to find other end of unix socket connection?

I have a process (dbus-daemon) which has many open connection over UNIX sockets. One of these connections is fd #36: =$ ps uw -p 23284 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME ...
3
votes
1answer
49 views

What does it mean for netstat -t

I see the help of netstat -t option says Displays the current connection offload state. And I tried it in the windows command console. The Offload State value display InHost. What does Offload ...
9
votes
6answers
7k views

netstat shows a listening port with no pid but lsof does not

This question is similar to Network port open, but no process attached? I've tried everything from there, reviewed the logs, etc... and can't find anything. My netstat shows a TCP listening port and ...
0
votes
1answer
176 views

Netstat - Thunderbird and others work on strange ports

I'm getting this: $ sudo netstat -alpv tcp 0 0 comp.local:35409 ey-in-f16.1e100.n:imaps ESTABLISHED 2782/thunderbird-bi tcp 0 0 comp.local:52950 ...
75
votes
4answers
79k views

What's the difference between ip address 0.0.0.0 and 127.0.0.1?

I do know that 127.0.0.1 ~ 127.255.255.254 are the loopback IP addresses for most modern operating systems and we could use these IP addresses to refer to our own computer. But what's 0.0.0.0? It ...
0
votes
0answers
73 views

netstat e on windows shows really high bytes count

running netstat /e is giving me strange results "bytes received" from netstat /e output is always way higher, about 10 times higher than when netsh interface ip show subinterfaces is run. wireshark ...
1
vote
2answers
72 views

Difference Between Netstat and Access Log

When I was checking stats in SSH terminal for my VPS, I noticed that netstat and access log gives different results. When I used: netstat -anp I saw that one attacker having 32 concurrent ...
0
votes
0answers
1k views

Windows TCP Port 139 Netbios-ssn vulnerability

I ran netstat -b on my computer. Two results showed that I do not understand, VAIO being another PC on the LAN. [firefox.exe] TCP 192.168.100.106:49186 VAIO:netbios-ssn TIME_WAIT TCP ...
0
votes
1answer
51 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk ...
1
vote
1answer
888 views

How to reset netstat -e counters

I would like to reset netstat -e counters. How can I do it? Renewing the network interface may reset these counters, but it is NOT an option - the networking must not be interrupted. My OS is ...
4
votes
7answers
21k views

Port 80 is being used by SYSTEM (PID 4), what is that?

I am trying to use port 80 for my application server, but when I perform "netstat -aon" I get TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 When I look up the process in ...
1
vote
2answers
78 views

How to find the count of Apache workers' at a given point for shared IPs?

One can find the number of Apache workers an IP address is consuming at an instantaneous point in time by executing: netstat -pantu | grep :80 |sort | uniq -c |grep <IP_HERE, eg: 192.168> | wc ...
3
votes
2answers
201 views

After kill -9 process won't disappear and port is still bound

We have a Java server application running on Mac OS X. Occasionally this application has become unresponsive, and we have resorted to killing it with kill -9. However, the process doesn't disappear; ...
5
votes
4answers
12k views

Running lsof -i shows a lot of connections in CLOSE_WAIT ? Should I worry

So I am running lsof -i | wc -l periodically and it is telling me that out of 420 lines, between 240 and 255 are in CLOSE_WAIT state. How does TCP connections enter this state ? Should I be worried ...
0
votes
2answers
250 views

What are records in 'netstat' command are when using logstash?

I use logstash with embedded elasticsearch. My logstash config looks like the following: output { tdout { debug => true debug_format => "json"} elasticsearch { embedded => true ...
1
vote
2answers
168 views

Can I find the list of ports being listened by a process ordered by the time of opening?

I know I can see the list of open ports using the lsof command. I am trying to view the results ordered by timestamp of listening. The process opens multiple (~6) ports and I suspect the order of ...
-3
votes
2answers
56 views

How to get the number of current connections to an external web service [closed]

My application makes many requests in a day to a webservice (say 172.20.20.20:11111) on a different server. I would like to know how I can count the number of connections that are established (the ...
0
votes
2answers
125 views

netstat brought up strange ip

I just ran netstat -vatn and found there was a connection ESTABLISHED on :22 from my ip and another unknown ip. Moments later I ran it again and found the connection was gone. I have a default ...
1
vote
0answers
421 views

What does “connections reset due to unexpected data” in netstat -s mean

I'm running a memcached server under heavy load from multiple web servers. While investigating some odd app level behaviour, we spotted that netstat -s on the memcached box was showing a lot of ...
5
votes
1answer
574 views

Why is rpc.lockd obscured from netstat/lsof output?

Prologue: On a number of machines, which happen to act as NFS clients, netstat reports two ports that are open with no PID listed for an associated daemon. Ordinarily this might be a bit concerning. ...
3
votes
1answer
468 views

Netstat hangs: why?

Sometimes (not too often at all) when I type "netstat", it takes over 5 seconds to return. While other times is instantaneous. I have been observing this for weeks on my server (CentOS 6.4), but I ...
1
vote
1answer
463 views

Lots of TIME_WAIT from same IP address

I've seen a lot of questions with people concerned about lots of TIME_WAITs in netstat. I'm having a similar problem but all the TIME_WAITs are coming from the same IP address. I get over 200 of the ...
0
votes
1answer
112 views

Port scanning from localhost

I see lot of tcp connections on different ports on my server with 'TIME_WAIT' status. Just simple port scan, but i cant see ip address of this bastard because connections is going from my nginx. Can ...
1
vote
1answer
105 views

How to find full process arguments and associated listening ports?

I can execute netstat -atulpn | grep java to find all Java processes with their accompanying ports, which is great, however I would like to also have the processes full execution arguments also shown. ...
2
votes
1answer
220 views

Find number of TCP bytes transmitted

I have rhel4 and rhel6 hosts. I can use netstat -s to see information on the number of segments sent/received. I can use ifconfig to see the number of bytes sent/received on a given interface (for ...
1
vote
2answers
479 views

Why is netstat -n different between Solaris and Linux and how can I make it the same?

When I run netstat -n on Solaris I get different results from netstat -n on Linux, even though according to the manual pages in Solaris and Linux the -n flag should do the same thing. My question: ...
1
vote
2answers
103 views

Linux: Find amount of “active” connections on one port

i need to monitor how many users are actively connected to one port on debian. I know i can do it with command netstat -na |grep $port |grep ESTABLISHED |wc -l which really gives me result - a ...