netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

-2
votes
0answers
15 views

High number of connections from own server [on hold]

When I run this command netstat -anp | grep tcp | awk '{print $5}' | cut -f 1 -d : | sort | uniq -c | sort -n it returns something like this ... 5 86.71.61.61 6 81.251.16.217 6 89.2.18.19 9 ...
1
vote
1answer
2k views

UDP port appears to be in use but is not shown in netstat or TCPView

I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen ...
10
votes
8answers
34k views

How do I get rid of sockets in FIN_WAIT1 state?

I have a port that is blocked by a process I needed to kill. (a little telnet daemon that crashed). The process was killed successfully but the port is still in a 'FIN_WAIT1' state. It doesn't come ...
2
votes
1answer
136 views

lsof doesn't show the established TCP connection

On my system, if I run the netstat for a port, it returns: $ netstat -nat | grep "60964" tcp 0 0 192.0.0.1:60964 0.0.0.0:* LISTEN tcp 59 0 ...
4
votes
2answers
2k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
2
votes
1answer
47 views

Is it possible to deterministically trace how port 80 is forwarded and where the configuration is on a given system?

Is there a way to determine or trace how a port forwarding configuration is set up on a system running Ubuntu 14.04 LTS, on which there is a NodeJS service running and somehow accepting connections ...
2
votes
1answer
30 views

Does the netstat counter wrap around? And over what period are they collected?

If I run netstat -s on my solaris 10 box, I got a lot of network statistics. Are these counters since the time of system boot, or some other arbitrary period? And some of the numbers are quite ...
97
votes
4answers
99k views

What's the difference between ip address 0.0.0.0 and 127.0.0.1?

I do know that 127.0.0.1 ~ 127.255.255.254 are the loopback IP addresses for most modern operating systems and we could use these IP addresses to refer to our own computer. But what's 0.0.0.0? It ...
0
votes
5answers
9k views

netstat shows many times deploy.akamaitechnologies.com connected to my server

Many times, after running netstat on my server, I find one of IP addresses belonging to deploy.akamaitechnologies.com connected to my server, do someone has an idea on what is happening on my server ? ...
0
votes
1answer
47 views

SSH Tunnel not working

I have a number of SSH tunnels set up between our company's server (hosts website) and our customer's servers (hosts database). For all sites but one the connection is relatively stable however one ...
2
votes
1answer
167 views

How to find full process arguments and associated listening ports?

I can execute netstat -atulpn | grep java to find all Java processes with their accompanying ports, which is great, however I would like to also have the processes full execution arguments also shown. ...
0
votes
1answer
38 views

How to use non-deprecated tools like ss to get process id running on a port?

I am looking for a non-deprecated way of running a command like netstat -tulpn | grep 8000 to output information about an active port. Any suggestions on how to use a tool like ss to get the process ...
-1
votes
1answer
68 views

Too large 127.0.0.1 connections with nginx - apache2 [duplicate]

I use nginx as proxy-server apache2 and I have a problem with netstat output: $ netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n 5 109.195.36.169 6 109.195.33.205 8 ...
-1
votes
1answer
74 views

Does “ESTABLISHED” state in netstat command for the sshd program mean they actually have access?

I have this person(or bot) from an IP in Chile which has an "ESTABLISHED" connection to SSHD as root on my server. I'm trying to understand what netstat's outputs really mean, the manual doesn't ...
1
vote
2answers
35 views

See stats of data in and out of each connection to a port

I have an application listening to a port. The clients connect to it using http connection. At any given time I see around 3000 connections established. I assume not all these connections are in use ...
0
votes
1answer
24 views

Concurrent connections per IP

I need to make a few changes to a firewall configuration, but before I do I'd like to see the number of concurrent Apache connections per IP. This command produces a nice list: #netstat -ntu | awk ...
0
votes
2answers
64 views

Print last column containing spaces and special characters

I need a full path/command thats been execued to start a process thats exposed on the network - listens on tcp/udp . I did manage to get all of that using below "one liner": netstat -nlp46|tail -n +3 ...
2
votes
1answer
862 views

iftop Shows Lots of Mysterious Connections - Not Showing in netstat

I've just stopped all pretty much all services except sshd on my server (Ubuntu Server 10.04), and when I run iftop I get output that looks like this: 12.5Kb 25.0Kb ...
2
votes
1answer
122 views

Is it normal to have many connections from my own server ip when I ran netstat command?

I would like to know if is it normal to have many connections from my own server ip when I ran: netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | ...
1
vote
0answers
66 views

Why is SQL Server using all ephemeral ports connecting to itself and causing TIME_WAITs?

I've got an AWS server with Windows 2008 R2, SQL Server 2012, and Tomcat 7. When I run netstat -ano the screen is flooded with TIME_WAIT. I posted the output in a Gist. When I run CurrPorts, filter ...
1
vote
0answers
121 views

TCP High Send-q coupled with FIN_WAIT1 status

I'm having a problem with one of my webservers, which is taking minutes to completely render a web page. I had a look at the TCP connection and noticed that I have a very high value in the send-q ...
0
votes
0answers
97 views

No connection available in pool. netstat RecvQ shows high number

In our servers there is one particular dependency (java jar), which makes a total of 1024 connection to various remote servers (the library works as a service discovery). Intermittently, it is ...
0
votes
1answer
677 views

Nginx not running with no error message (ubuntu 14.04 lts)

I am trying to start my nginx server. When I type "$> /etc/init.d/nginx start", I have a message appearing "Starting nginx: Ok", and then nothing happens. When I type "sudo lsof -nP -i | grep ...
4
votes
2answers
776 views

How to make netstat on Linux only show OUTBOUND tcp connections?

My ubuntu server is infected and there is a process making a bunch of HTTP requests to a bunch of websites (sucks!). I have added the following to my firewall (UFW): sudo ufw deny out proto tcp to ...
0
votes
0answers
29 views

netstat output without PID

I just stumbled across this issue with the netstat output on my server, There are a couple of ports which are listening, but do not have a PID attached to it. I want to make sure they are not ...
1
vote
1answer
205 views

Port suddenly closed. How to re-open?

I've written a software module in PHP that manages the saving of data in different data stores (MySQL, ElasticSearch and Redis). To test the module, I've created several test plans in Apache JMeter, ...
2
votes
2answers
113 views

Limit to number of listening ports in linux

I have tried to launch a script to listen to thousands of tcp ports (1000 to 10000) but it appears to be hitting a limit of 1024 listening ports. I've confirmed this via netstat and closed ports above ...
1
vote
0answers
41 views

How to check a given connection has been offloaded to network card

From what I read, some part of the tcp protocol operation can be offloaded from kernel to network card driver thanks to TOE (or GSO, LSO, LRO..). My objective is too find if a given socket has some ...
0
votes
1answer
60 views

Simulation of TX/RX Drop

I'm trying to get the "TX/RX Drop" values to increase. I've tried dropping packets using both iperf and iptables but the statistics aren't increasing even when packets are being dropped. Is there a ...
1
vote
0answers
75 views

iptables traffic after forwarding

I have 2 servers Server A and Server B ServerA = 1.1.1.1 ServerB = 2.2.2.2 I am using ip-tables to send all traffic on port 80 to Server B on Server (A) 1.1.1.1 i have done iptables -t nat -A ...
0
votes
0answers
92 views

Ghost tcp connections: ss sees them, nothing else does

We have a strange problem. Our remote server shows over 900 connections coming from our office over port 80: # ss -n | grep ESTAB | grep $OFFICEIP | grep :80 | wc -l 935 Netstat shows a similar ...
0
votes
2answers
693 views

Netstat count TIME_WAIT connections by port

I can obtain individual TIME_WAIT counts on a port, netstat -nat | grep :11300 | grep TIME_WAIT | wc -l; but how to do this based on all ports eg: 11300 2900 connection 3306 1200 connection ...
0
votes
2answers
128 views

Display IP & TCP statistics per interface (netstat -s with interface)

Linux has the ability to display protocol statistics with netstat -s. The output looks something like: Excerpt: 7487 times unabled to send RST due to no memory TCPDSACKIgnoredOld: 817 ...
1
vote
1answer
147 views

Limit Number of TCP connections in Linux Server, to avoid attack

I want to limit the number of TCP connections in Linux server, I have used the following command. iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 25 --connlimit-mask 32 ...
0
votes
2answers
2k views

How does netstat get a hostname from IP while nslookup & nblookup fail every time?

In Windows Server 2003, when I run netstat with no flags, it takes much longer than netstat -n to return results. I realize this is because it has to perform reverse lookups by IP address to get the ...
1
vote
4answers
286 views

Is there a netstat -s equivalent for windows?

I know that netstat -s exists on Windows, but it displays way less informations than on Linux/OS X. It only gives 8 counters about TCP, while on Linux it's more than 50. I'm looking for any ...
0
votes
1answer
103 views

Port 80 doesn't work

I have a website in my ubuntu server 14.04, with apache2 server, and untils fews days go the site works fine but, today if I digit www.mydomain.com from my internal network it works but, if I try with ...
1
vote
5answers
254 views

Get number of TCP established connections

On a Linux server one can use netstat -tan | grep ESTABLISHED| wc -l but this will not work on a high load server with watch -n1. Such approach works fine if the server is not very busy or the ...
0
votes
1answer
271 views

What causes “SYN to LISTEN sockets dropped”?

A quite busy proxy server has lots of "SYNs to LISTEN sockets dropped". I learned one cause could be a too small backlog size. But in that case the "times the listen queue of a socket overflowed" ...
0
votes
0answers
83 views

xinetd stops working in Debian Wheezy

We have a server with a whois service running. The whois service is provided by xinetd. The configuration file /etc/xinetd.d/whois looks like this: service whois { socket_type = stream ...
19
votes
5answers
20k views

How to find other end of unix socket connection?

I have a process (dbus-daemon) which has many open connection over UNIX sockets. One of these connections is fd #36: =$ ps uw -p 23284 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME ...
3
votes
1answer
152 views

What does it mean for netstat -t

I see the help of netstat -t option says Displays the current connection offload state. And I tried it in the windows command console. The Offload State value display InHost. What does Offload ...
9
votes
6answers
9k views

netstat shows a listening port with no pid but lsof does not

This question is similar to Network port open, but no process attached? I've tried everything from there, reviewed the logs, etc... and can't find anything. My netstat shows a TCP listening port and ...
0
votes
1answer
183 views

Netstat - Thunderbird and others work on strange ports

I'm getting this: $ sudo netstat -alpv tcp 0 0 comp.local:35409 ey-in-f16.1e100.n:imaps ESTABLISHED 2782/thunderbird-bi tcp 0 0 comp.local:52950 ...
0
votes
0answers
117 views

netstat e on windows shows really high bytes count

running netstat /e is giving me strange results "bytes received" from netstat /e output is always way higher, about 10 times higher than when netsh interface ip show subinterfaces is run. wireshark ...
1
vote
2answers
102 views

Difference Between Netstat and Access Log

When I was checking stats in SSH terminal for my VPS, I noticed that netstat and access log gives different results. When I used: netstat -anp I saw that one attacker having 32 concurrent ...
0
votes
0answers
3k views

Windows TCP Port 139 Netbios-ssn vulnerability

I ran netstat -b on my computer. Two results showed that I do not understand, VAIO being another PC on the LAN. [firefox.exe] TCP 192.168.100.106:49186 VAIO:netbios-ssn TIME_WAIT TCP ...
0
votes
1answer
86 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk ...
1
vote
1answer
1k views

How to reset netstat -e counters

I would like to reset netstat -e counters. How can I do it? Renewing the network interface may reset these counters, but it is NOT an option - the networking must not be interrupted. My OS is ...
4
votes
7answers
24k views

Port 80 is being used by SYSTEM (PID 4), what is that?

I am trying to use port 80 for my application server, but when I perform "netstat -aon" I get TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 When I look up the process in ...