netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

8
votes
2answers
1k views

Where are my TIME_WAITs on Mac OS X?

No TIME_WAITs on Mac OS X Normally, when a TCP connection is closed, the socket on the side where close() is called first is left in the TIME_WAIT state. When one of the peers is a Mac OS X (Lion) ...
3
votes
2answers
4k views

UDP port appears to be in use but is not shown in netstat or TCPView

I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen ...
1
vote
2answers
48 views

See stats of data in and out of each connection to a port

I have an application listening to a port. The clients connect to it using http connection. At any given time I see around 3000 connections established. I assume not all these connections are in use (...
1
vote
2answers
473 views

Linux: How to display all sockets opened for a particular interface?

How can I display all sockets opened for a particular interface?
1
vote
1answer
246 views

Netstat showing multiple connections for on ssh login

I connect to my server via ssh. I am the only person who has access to connect to the server. After connecting via ssh, I run the following command: sudo netstat -tupn The output includes the ...
1
vote
1answer
224 views

Limit Number of TCP connections in Linux Server, to avoid attack

I want to limit the number of TCP connections in Linux server, I have used the following command. iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 25 --connlimit-mask 32 -...
1
vote
1answer
1k views

Lots of TIME_WAIT from same IP address

I've seen a lot of questions with people concerned about lots of TIME_WAITs in netstat. I'm having a similar problem but all the TIME_WAITs are coming from the same IP address. I get over 200 of the ...
1
vote
1answer
174 views

Confusing traffic in netstat, nothing in logs

Just had a confusing couple of minutes! I was monitoring a screen (the gnu screen) running "netstat -a" and I noticed that there was one connection connected to http (port 80), fine. But when I ...
1
vote
1answer
553 views

nginx serving .php as static files

ok, again apparently a totally ridiculous problem which I just can't seem to figure out. nginx keeps serving my .php files as static files. I've installed nginx via the repositories on ubuntu. I've ...
1
vote
1answer
1k views

netstat -e: high discards and errors

I think my network is congested because of the relatively large discards and errors data. They should be zero or at least close to that. Here is the output of netstat -e on my computer: Interface ...
1
vote
1answer
200 views

Netstat flags on OS/2

On an OS/2 box, what do the flags UGDP mean in the output of netstat -r. Google seems to point to them meaning Up, Gateway (i.e. an indirect root), and Dynamic (learned from a redirect), but that ...
0
votes
1answer
19 views

PID 4 Using Port 80 - IIS Unable To Bind

So I've been having a problem where I can't use localhost:80 on IIS So I ran this: > netstat -ano | find "0:80" And got: TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 ...
0
votes
1answer
36 views

Netcat - socket in time_wait when echoing and piping, but not when invoked directly

I'm testing an application using netcat (nc) and I'm getting very low throughput on network connections. When I ran netstat -tnpo I see numerous TCP sessions in TIME_WAIT. I'm sending data to my ...
0
votes
1answer
103 views

Concurrent connections per IP

I need to make a few changes to a firewall configuration, but before I do I'd like to see the number of concurrent Apache connections per IP. This command produces a nice list: #netstat -ntu | awk '{...
0
votes
1answer
87 views

Simulation of TX/RX Drop

I'm trying to get the "TX/RX Drop" values to increase. I've tried dropping packets using both iperf and iptables but the statistics aren't increasing even when packets are being dropped. Is there a ...
0
votes
1answer
155 views

Port 80 doesn't work

I have a website in my ubuntu server 14.04, with apache2 server, and untils fews days go the site works fine but, today if I digit www.mydomain.com from my internal network it works but, if I try with ...
0
votes
1answer
513 views

how to display netstat output on nagios

Can you please tell me how to monitor an established connection (on a specified port) in a windows machine from nagios (centOS) here an example (output of netstat): Proto Local Address ...
0
votes
1answer
116 views

Strange ports on default install of W7

I have a base new install of windows 7, and when I went to look for something else I saw the attached netstat output. What concerns me is that this is Windows + Truecrypt + drivers, nothing else ...
0
votes
1answer
325 views

Apache2 many CLOSE_WAIT. LAMP. Locating the issue

I've got a LAMP setup running and I seem to have many CLOSE_WAIT connections for apache2 program when I netstat (several hundred). This eventually causes my apache to become unresponsive. Bellow is ...
0
votes
1answer
299 views

How can I find the cause of an unknown connection showing in iftop?

I have connections like this showing frequently in iftop: 12.15.127.75.host.nwnx.net => 121.61.153.172 480b 160b 40b I have no idea ...
0
votes
1answer
953 views

Apache creates lots of processes in CLOSE_WAIT state and than crashes

I have a web server (centos) with Apache 2.4.3 and in peak times Apache becomes unresponsive until I restart it. Before it happens there is suddenly spike of httpd proccesses count and it seems that ...
0
votes
1answer
176 views

ss utility does't work properly

I've learned that ss, which is base on netlink, is much faster than netstat when amount of sockets is large. And the secret is here. But when I tested on my suse linux minutes ago, the result ...
0
votes
1answer
463 views

fast opening and closing connection with a specific port

We have a Main application named "Trevor" installed in 2008R2 machine named "TEAMER12" which is slow now. One more application named "TVS" also running in and found there were many connections per ...
0
votes
1answer
1k views

FileMaker Server not listening on Port 2399 for ODBC/JDBC

I am trying to create a ODBC connection from an OSX machine to a Filemaker server 10 using a DataDirect SeQuel Link 5.5 JDBC drive. I have ODBC/JDBC enabled on the server and I followed all of the ...
4
votes
0answers
764 views

What does “connections reset due to unexpected data” in netstat -s mean

I'm running a memcached server under heavy load from multiple web servers. While investigating some odd app level behaviour, we spotted that netstat -s on the memcached box was showing a lot of "...
2
votes
0answers
290 views

How to resolve UDP packets being dropped given netstat reporting SndbufErrors

I have a server instance on an OpenStack that at a pretty high load starts loosing UDP packets. I captured all outgoing packets using tcpdump and some of them are missing, even though application logs ...
2
votes
0answers
63 views

cannot bind a port altough LISTEN

I'm new to this problem I'm using Ubuntu 12.04 LTS via VMware My problem is to bind port 6703 i tried alot of commands to check if this port or open or not Error Message is Failed to bind to: 0....
2
votes
0answers
149 views

Why is SQL Server using all ephemeral ports connecting to itself and causing TIME_WAITs?

I've got an AWS server with Windows 2008 R2, SQL Server 2012, and Tomcat 7. When I run netstat -ano the screen is flooded with TIME_WAIT. I posted the output in a Gist. When I run CurrPorts, filter ...
2
votes
0answers
708 views

Netstat Send-Q High

Am using Ubuntu Server 10.10 and when i do netstat -tuna i get the many connections with Send-Q very high, 23K, 50K, 100K. This users report that they have latency problems when connecting to the ...
1
vote
0answers
27 views

Why netstat -p doesn't show PID of established connections?

I have some REST service which is listening on tcp/8051 I'm querying this service with curl in infinite loop from the same host: while true; do curl --header "Authorization: Bearer ...
1
vote
0answers
31 views

How to aggregate reports given by nestat?

In this question OP gives some reports that has been generated with netstat. However, the more I look at the switches of netstat, the less I can find how to generate that report. The sample report is:...
1
vote
0answers
164 views

How to diagnose netstat: no namelist

I had to replace an NIC on my HP Proliant Microserver, running FreeNAS 9.3 In my crashplan jail, I now get "netstat: no namelist" as a response when I execute the netstat command. How to I diagnose ...
1
vote
0answers
87 views

What exactly constitutes a bad TCP segment?

What constitutes a bad segment as in bad segments received in the netstat output below? I would think a TCP header's checksum could do it, but are there other things? If a segment arrives after its ...
1
vote
0answers
280 views

TCP High Send-q coupled with FIN_WAIT1 status

I'm having a problem with one of my webservers, which is taking minutes to completely render a web page. I had a look at the TCP connection and noticed that I have a very high value in the send-q ...
1
vote
0answers
74 views

How to check a given connection has been offloaded to network card

From what I read, some part of the tcp protocol operation can be offloaded from kernel to network card driver thanks to TOE (or GSO, LSO, LRO..). My objective is too find if a given socket has some ...
1
vote
0answers
174 views

iptables traffic after forwarding

I have 2 servers Server A and Server B ServerA = 1.1.1.1 ServerB = 2.2.2.2 I am using ip-tables to send all traffic on port 80 to Server B on Server (A) 1.1.1.1 i have done iptables -t nat -A ...
1
vote
0answers
370 views

how to get send-q and receive-q on windows server

in linux, is very easy to troubleshoot a remote connection problem because netstat show the send-q and recv-q. This is very useful because we can know if the remote peer is reading the server send ...
0
votes
0answers
28 views

Can't bind UDP socket but port is free

I've been struggling for a while now with this so maybe someone here is able to help me. I'm setting up a CS:GO server that's going to be running on port 27059. (This is a copy&paste from a ...
0
votes
0answers
30 views

IIS6 - localhost/MachineName IP/Ports configuration Error after system crash and Restore

Six months ago my hosted win 2003 server crashed due to RAID drive issues while at the datacentre and I lost my installation. After a re-install I recovered my websites, (with help .. approx. 10) and ...
0
votes
0answers
13 views

netstats shows my own server is hitting a server its not supposed to know about

ON AWS I have a few dedicated servers that do image processing and they seem to get high traffic and fail. when running netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n I ...
0
votes
0answers
36 views

netstat result showing syn sent for specific ip (local) which is not exist in LAN

I was using my web server (jboss) in different subnet (192.168.150.10/24) and after sometime, just changed to another subnet (192.168.200.20/24). But still i could see in netstat -pnt result, my new ...
0
votes
0answers
465 views

Weird CLOSE_WAIT statuses at standard PHP application

I am asking for help regarding tcp problems on a webserver serving a web application built in PHP. The client is a standard html/js page viewed in the web browser. This client sends Ajax requests ...
0
votes
0answers
58 views

What does `SYNs to LISTEN sockets dropped` from `netstat -s` mean

I could found 437 SYNs to LISTEN sockets dropped from netstat -s from the server on my server which runs nginx. I found this explanation from the man page: --statistics, -s, Display summary ...
0
votes
0answers
23 views

netstat -r on debian give abnormal output

after looking for stuff with Debian "netstat" and try list stuff with "nestat -r" my main Server out a Long list of unkown Hosts ( mostly hacked IP´s by looking on abuseDB ) here a small example for ...
0
votes
0answers
187 views

IPA Server installation: Error with port number

When I am trying to install IPA server, I am getting the following error : IPA requires port 8443 for PKI but it is currently in use. Aborting installation I checked with netstat -tuplen | grep ...
0
votes
0answers
975 views

Synology open for Cloud Station even if blocking 6690 port

I have a NAS Synology beyong my Internet Box. On the Internet Box, I have UPnP not activated and I have only activated on Port Transfer the following ports : 1701/UDP, 500/UDP and 4500/UDP which are ...
0
votes
0answers
298 views

No connection available in pool. netstat RecvQ shows high number

In our servers there is one particular dependency (java jar), which makes a total of 1024 connection to various remote servers (the library works as a service discovery). Intermittently, it is ...
0
votes
0answers
211 views

Ghost tcp connections: ss sees them, nothing else does

We have a strange problem. Our remote server shows over 900 connections coming from our office over port 80: # ss -n | grep ESTAB | grep $OFFICEIP | grep :80 | wc -l 935 Netstat shows a similar ...
0
votes
0answers
227 views

netstat e on windows shows really high bytes count

running netstat /e is giving me strange results "bytes received" from netstat /e output is always way higher, about 10 times higher than when netsh interface ip show subinterfaces is run. wireshark ...
0
votes
0answers
4k views

Windows TCP Port 139 Netbios-ssn vulnerability

I ran netstat -b on my computer. Two results showed that I do not understand, VAIO being another PC on the LAN. [firefox.exe] TCP 192.168.100.106:49186 VAIO:netbios-ssn TIME_WAIT TCP 192.168.100....