Questions tagged [netstat]
netstat is a tool for viewing active network connections, listeners and sockets.
87
questions with no upvoted or accepted answers
4
votes
0
answers
1k
views
Find the process listening on a port (not showing in lsof)
Update:
The port was opened by NFS. I figured this out by configuring NFS to listen on a known port.
Using Ubuntu 18.04
I want to know which process or kernel function listens on UDP port 38637.
I ...
3
votes
0
answers
221
views
How to tell whether a linux tcp socket had recent activity?
Most of the time, when changing or upgrading a network service, I would do this during maintenance hours but some services are rarely used so it is tempting to just check whether it is currently in ...
3
votes
0
answers
1k
views
Kernel TCP tuning for buffer overrun and packet collapse
We have a Nginx+Ruby application where the data between Nginx and the application are interfaced through a socket.
As part of performance improvement, when we analyzed the netstat statistics on the ...
3
votes
0
answers
912
views
Windows netstat vs WMIC bytes sent/received difference
I'm trying to understand the difference between the bytes sent/received values returned by both netstat and wmic on Windows. I'm having a hard time finding an explanation for the significant variation....
3
votes
0
answers
3k
views
Can't bind UDP socket but port is free
I've been struggling for a while now with this so maybe someone here is able to help me.
I'm setting up a CS:GO server that's going to be running on port 27059.
(This is a copy&paste from a ...
3
votes
0
answers
576
views
Why netstat -p doesn't show PID of established connections?
I have some REST service which is listening on tcp/8051
I'm querying this service with curl in infinite loop from the same host:
while true; do curl --header "Authorization: Bearer ...
3
votes
0
answers
907
views
How to diagnose netstat: no namelist
I had to replace an NIC on my HP Proliant Microserver, running FreeNAS 9.3
In my crashplan jail, I now get "netstat: no namelist" as a response when I execute the netstat command. How to I diagnose ...
3
votes
0
answers
1k
views
What exactly constitutes a bad TCP segment?
What constitutes a bad segment as in bad segments received in the netstat output below? I would think a TCP header's checksum could do it, but are there other things? If a segment arrives after its ...
3
votes
0
answers
843
views
Why is SQL Server using all ephemeral ports connecting to itself and causing TIME_WAITs?
I've got an AWS server with Windows 2008 R2, SQL Server 2012, and Tomcat 7. When I run netstat -ano the screen is flooded with TIME_WAIT. I posted the output in a Gist.
When I run CurrPorts, filter ...
3
votes
0
answers
674
views
netstat e on windows shows really high bytes count
running netstat /e is giving me strange results
"bytes received" from netstat /e output is always way higher, about 10 times higher than when netsh interface ip show subinterfaces is run. wireshark ...
3
votes
0
answers
1k
views
Netstat Send-Q High
Am using Ubuntu Server 10.10 and when i do netstat -tuna i get the many connections with Send-Q very high, 23K, 50K, 100K. This users report that they have latency problems when connecting to the ...
2
votes
1
answer
3k
views
Debian 8 - getnameinfo Failed Error - netstat
I am experiencing a error/warning when running any netstat command on my Debian 8 machine.
One of the commands:-
netstat | grep http | wc -l
The result:-
getnameinfo failed
getnameinfo failed
...
2
votes
0
answers
3k
views
In the output of netstat -r, what is the meaning of the "Netif" column and how does it differ to the "Gateway" column?
I can find virtually no documentation of the meaning of the column "Netif" in the output of netstat -rn. Googled for it, searched through the netstat(1) and route(8) man pages and found the following ...
2
votes
0
answers
533
views
How to aggregate reports given by nestat?
In this question OP gives some reports that has been generated with netstat. However, the more I look at the switches of netstat, the less I can find how to generate that report.
The sample report is:...
2
votes
0
answers
8k
views
How to resolve UDP packets being dropped given netstat reporting SndbufErrors
I have a server instance on an OpenStack that at a pretty high load starts loosing UDP packets. I captured all outgoing packets using tcpdump and some of them are missing, even though application logs ...
2
votes
0
answers
406
views
cannot bind a port altough LISTEN
I'm new to this problem I'm using Ubuntu 12.04 LTS via VMware
My problem is to bind port 6703 i tried alot of commands to check if this port or open or not
Error Message is
Failed to bind to: 0....
2
votes
1
answer
3k
views
Netstat showing multiple connections for on ssh login
I connect to my server via ssh. I am the only person who has access to connect to the server. After connecting via ssh, I run the following command:
sudo netstat -tupn
The output includes the ...
2
votes
2
answers
935
views
Linux: How to display all sockets opened for a particular interface?
How can I display all sockets opened for a particular interface?
1
vote
0
answers
143
views
What does it mean when netstat outputs a dash in pid / program name column?
Here is some lightly modified output from netstat (I removed the addresses and names)
a@xxxxx:/app# netstat -p
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address ...
1
vote
0
answers
178
views
How to identify which os process is establishing a proxy connection
Platform: Red-Hat 7
I hope you can help me with this. I've been told that one proxy server we are using is going to be decommissioned in the following days. I've tried to use netstat in order to ...
1
vote
0
answers
284
views
Get information about socket of unknown domain
The output of lsof (revision: 4.87) on centos 7.8.2003 shows:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
java 30858 xxxx 841u sock 0,7 ...
1
vote
0
answers
492
views
Iptables rule for limiting connections per ip
I'm usig the following iptable rule to limit the amount of simultaneous connections to 1 connection per ip, on port 4387.
/sbin/iptables -A INPUT -p tcp --syn --dport 3387 -m connlimit --connlimit-...
1
vote
0
answers
437
views
IP Show on netstat -n
Could someone with more experience help me in this?
I have an idea in my head and i've been trying to put it into practice.
I have two machines, one where the application is hosted (I'll call it "...
1
vote
0
answers
75
views
Duplicate Local Port in Virtual Guest's /proc/net/tcp
I'd like to understand the following two entries in my VirtualBox's guest's /proc/net/tcp:
6: 00000000:18EB 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 9581 1 ...
1
vote
1
answer
117
views
Why is kjournald showing up 700 times in `netstat`?
AFAIK, kjournald is not a network program, but a program that deals with the journal of EXT3 (I am running EXT4 on Ubuntu 16.04). Still, when running sudo netstap -tapn it shows up almost 700 times, ...
1
vote
0
answers
379
views
How to configure Linux to close the connection if Send-Q is never sent?
There is a TCP client-server connection. The application on the server is sending data regularly. Client machine is then reset physically. Netstat shows Send-Q on the server is filling up, the ...
1
vote
0
answers
38
views
netstats shows my own server is hitting a server its not supposed to know about
On AWS I have a few dedicated servers that do image processing, and they seem to get high traffic and fail.
When running
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
I ...
1
vote
0
answers
3k
views
Synology open for Cloud Station even if blocking 6690 port
I have a NAS Synology beyong my Internet Box. On the Internet Box, I have UPnP not activated and I have only activated on Port Transfer the following ports : 1701/UDP, 500/UDP and 4500/UDP which are ...
1
vote
2
answers
146
views
See stats of data in and out of each connection to a port
I have an application listening to a port. The clients connect to it using http connection. At any given time I see around 3000 connections established. I assume not all these connections are in use (...
1
vote
0
answers
1k
views
TCP High Send-q coupled with FIN_WAIT1 status
I'm having a problem with one of my webservers, which is taking minutes to completely render a web page.
I had a look at the TCP connection and noticed that I have a very high value in the send-q ...
1
vote
0
answers
311
views
How to check a given connection has been offloaded to network card
From what I read, some part of the tcp protocol operation can be offloaded from kernel to network card driver thanks to TOE (or GSO, LSO, LRO..).
My objective is too find if a given socket has some ...
1
vote
0
answers
1k
views
iptables traffic after forwarding
I have 2 servers
Server A and Server B
ServerA = 1.1.1.1
ServerB = 2.2.2.2
I am using ip-tables to send all traffic on port 80 to Server B
on Server (A) 1.1.1.1
i have done
iptables -t nat -A ...
1
vote
0
answers
986
views
Ghost tcp connections: ss sees them, nothing else does
We have a strange problem. Our remote server shows over 900 connections coming from our office over port 80:
# ss -n | grep ESTAB | grep $OFFICEIP | grep :80 | wc -l
935
Netstat shows a similar ...
1
vote
3
answers
4k
views
Limit Number of TCP connections in Linux Server, to avoid attack
I want to limit the number of TCP connections in Linux server, I have used the following command.
iptables -A INPUT -p tcp --syn --dport 80 -m connlimit
--connlimit-above 25 --connlimit-mask 32 -...
1
vote
1
answer
1k
views
Apache2 many CLOSE_WAIT. LAMP. Locating the issue
I've got a LAMP setup running and I seem to have many CLOSE_WAIT connections for apache2 program when I netstat (several hundred). This eventually causes my apache to become unresponsive.
Bellow is ...
1
vote
1
answer
219
views
Confusing traffic in netstat, nothing in logs
Just had a confusing couple of minutes! I was monitoring a screen (the gnu screen) running "netstat -a" and I noticed that there was one connection connected to http (port 80), fine. But when I ...
1
vote
1
answer
710
views
nginx serving .php as static files
ok, again apparently a totally ridiculous problem which I just can't seem to figure out.
nginx keeps serving my .php files as static files.
I've installed nginx via the repositories on ubuntu. I've ...
1
vote
1
answer
252
views
Netstat flags on OS/2
On an OS/2 box, what do the flags UGDP mean in the output of netstat -r. Google seems to point to them meaning Up, Gateway (i.e. an indirect root), and Dynamic (learned from a redirect), but that ...
1
vote
1
answer
4k
views
Lots of TIME_WAIT from same IP address
I've seen a lot of questions with people concerned about lots of TIME_WAITs in netstat. I'm having a similar problem but all the TIME_WAITs are coming from the same IP address. I get over 200 of the ...
0
votes
0
answers
53
views
Difference Send-Q between netstat and ss
The ss send-Q column shows non-zero value constantly, while netstat shows Send-Q as zero for same port and same process. Can you please let me know why like this and what does mean by non-zero value.
...
0
votes
0
answers
85
views
Martian packet with ARP broadcast traffic
Server nodes keep getting ARP broadcast traffic and becoming martian packets due to assymatric routing. I was known that when strict filtering is enabled with net.ipv4.conf.eth0.rp_filter = 1, the ...
0
votes
0
answers
82
views
PHP Error waiting on socket
I'm getting problems with ssh2 and fread php function that started on a few days.
On the apache error log show:
ssh2_connect(): Error starting up SSH connection(-9): Error waiting on socket
fread(): ...
0
votes
0
answers
39
views
fuser not listing the process even netstat and lsof list
hostserver:~# lsof | grep *:6343
sflowtool 979324 root 3u IPv6 1443815323 0t0 UDP *:6343
hostserver:~# netstat -ntlup | grep 6343
udp6 0 ...
0
votes
0
answers
119
views
Can't create a pseudo network interface on Debian 11
I have a KVM based Debian 11 (bullseye) VPS with internet access on eth0 network adapter. The public IP has been assigned by DHCP. The IPs and Routes are as what follows:
ifconfig and iptable BEFORE ...
0
votes
1
answer
405
views
NetStat Group By Process Id and Show Count
Is there any way to group the output given by netstat into process? I am running netstat -ano and doing manual count to know which process is using how many ports. I am using Windows Server.
We have ...
0
votes
0
answers
191
views
how to continues netstat a port and save it to text file with time stamp for each netstat
I am using a system which is integrated to other system using a specific port and recently I am facing multiple interruption in the integration, and I need to monitor the port "48823" for a ...
0
votes
0
answers
558
views
Why NFS is listening to a port but not showing the process name, is there any security risk if no firewall is set?
I'm using ubuntu 22.04 and have mounted an NFS storage, here is my fstab file
ftpback-bhs5-26.ip-149-56-30.net:/export/ftpbackup/ns524316.ip-xxx-xxx-xxx.net /media/backup nfs vers=4.0 0 0
When ...
0
votes
1
answer
1k
views
Nginx change default IP form 0.0.0.0 to pecific IP
I have nginx running as a web server.
The virtual host have the IP specific configuration with IP addresses listed, however whtn I check netstat Nginx is litening on 0.0.0.0:80. I would like to change ...
0
votes
0
answers
311
views
How to block flooding "empty" connections from single IP
Right now netstat lists 200 - 4000 connections to the same IP in India. Seems like some kind of flooding attack to me.
e.g:
tcp 0 0 [removed] 182.65.238.[removed].in-:mysql TIME_WAIT
I've ...
0
votes
0
answers
103
views
Showing all http connections in vm instance
I have a Google Cloud VM instance running Debian and a dockerized Apache httpd inside. I'm trying to count all the http connections in the machine.
I run this:
for i in {1..1000}; do netstat -at | wc -...