netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

19
votes
5answers
83k views

Huge amount of TIME_WAIT connections says netstat

Okay, this is creeping me out - I see about 1500-2500 of these: root@wherever:# netstat Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 ...
11
votes
5answers
13k views

netstat shows a listening port with no pid but lsof does not

This question is similar to Network port open, but no process attached? I've tried everything from there, reviewed the logs, etc... and can't find anything. My netstat shows a TCP listening port and ...
136
votes
4answers
135k views

What's the difference between ip address 0.0.0.0 and 127.0.0.1?

I do know that 127.0.0.1 ~ 127.255.255.254 are the loopback IP addresses for most modern operating systems and we could use these IP addresses to refer to our own computer. But what's 0.0.0.0? It ...
-1
votes
2answers
31k views

Avoid TIME_WAIT connections [duplicate]

When I use netstat command it shows.. tcp 0 0 localhost:18056 localhost:mysql TIME_WAIT tcp 0 0 localhost:16683 localhost:mysql ...
5
votes
5answers
10k views

Network port open, but no process attached?

I have a weird situation going on with an open network port. My main question is, why would there not be a program associated with an open TCP port: netstat -ln --program Active Internet connections ...
6
votes
4answers
17k views

Running lsof -i shows a lot of connections in CLOSE_WAIT ? Should I worry

So I am running lsof -i | wc -l periodically and it is telling me that out of 420 lines, between 240 and 255 are in CLOSE_WAIT state. How does TCP connections enter this state ? Should I be worried ...
1
vote
3answers
3k views

Too Many ESTABLISHED connection from a single IP address in Apache

netstat -ntp |grep 80 shows too many ESTABLISHED connection from single IP address. Around 300 of them and it is not an attack and user is using a 2G connection to access Apache. This is the case ...
1
vote
4answers
3k views

Netstat: How to know if it's Human or Bot/Spider/DDOS

I'm using the following command to check how many connections I have from a single ip netstat -anp |grep ':80' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n If it's DDOS attack(500+ ...
1
vote
5answers
849 views

Httpd problem, suspect an attack but not sure

On one of my servers when I type netstat -n I get a huge output, something like 400 entries for httpd. The bandwidth on the server isn't high, so I'm confused as to what's causing it. I'm suspecting ...
24
votes
6answers
28k views

How to find other end of unix socket connection?

I have a process (dbus-daemon) which has many open connection over UNIX sockets. One of these connections is fd #36: =$ ps uw -p 23284 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME ...
12
votes
4answers
48k views

How do I make cURL use keepalive from the command line?

I'm trying to verify that HTTP persistent connections are being used during communication with a Tomcat webserver I've got running. Currently, I can retrieve a resource on my server from a browser ...
7
votes
3answers
7k views

TIME_WAIT connections not being cleaned up after timeout period expires

I am stress testing one of my servers by hitting it with a constant stream of new network connections, the tcp_fin_timeout is set to 60, so if I send a constant stream of something like 100 requests ...
2
votes
1answer
7k views

TIME_WAIT in netstat of Apache processes

What are the meaning of the TIME_WAIT when using netstat of my web server process? I am sure the web server is not over loaded. tcp 0 0 0.0.0.0:80 0.0.0.0:* ...
5
votes
1answer
698 views

Why is rpc.lockd obscured from netstat/lsof output?

Prologue: On a number of machines, which happen to act as NFS clients, netstat reports two ports that are open with no PID listed for an associated daemon. Ordinarily this might be a bit concerning. ...
4
votes
2answers
5k views

How to make netstat on Linux only show OUTBOUND tcp connections?

My ubuntu server is infected and there is a process making a bunch of HTTP requests to a bunch of websites (sucks!). I have added the following to my firewall (UFW): sudo ufw deny out proto tcp to ...
1
vote
2answers
3k views

FreeBSD Listen Queue Overflows - can't increase max queue size

I have a decently high trafficked FreeBSD Nginx server, and I'm starting to get a large number of listen queue overflows: [root@svr ~]# netstat -sp tcp | fgrep listen 80361931 listen queue overflows ...
2
votes
1answer
762 views

Can't Access CouchDB Remotely

Please keep in mind that I have this installed on an Amazon EC2 instance running the latest version of Ubuntu Server. I have changed the bind_address to 0.0.0.0. netstat -an | grep 5984 yields the ...
1
vote
1answer
64 views

HTTPD listening in IPv6, according netstat, but reacheable in IPv4

Using Openstack, I have a Web GUI (horizon) hosted on my server (HTTPS). When I do a netstat -lt | grep https, I have: tcp6 0 0 [::]:https [::]:* LISTEN ...
1
vote
3answers
983 views

Linux : restricting outgoing on an application basis

I typed : netstat -atlpvn and noticed that applications like gedit and python had foreign addresses outside the network (the network being a single computer connected to the internet). Is there ...