Questions tagged [netstat]

netstat is a tool for viewing active network connections, listeners and sockets.

87 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
1k views

Find the process listening on a port (not showing in lsof)

Update: The port was opened by NFS. I figured this out by configuring NFS to listen on a known port. Using Ubuntu 18.04 I want to know which process or kernel function listens on UDP port 38637. I ...
jchook's user avatar
  • 141
3 votes
0 answers
221 views

How to tell whether a linux tcp socket had recent activity?

Most of the time, when changing or upgrading a network service, I would do this during maintenance hours but some services are rarely used so it is tempting to just check whether it is currently in ...
Gamification's user avatar
3 votes
0 answers
1k views

Kernel TCP tuning for buffer overrun and packet collapse

We have a Nginx+Ruby application where the data between Nginx and the application are interfaced through a socket. As part of performance improvement, when we analyzed the netstat statistics on the ...
madu's user avatar
  • 153
3 votes
0 answers
912 views

Windows netstat vs WMIC bytes sent/received difference

I'm trying to understand the difference between the bytes sent/received values returned by both netstat and wmic on Windows. I'm having a hard time finding an explanation for the significant variation....
elti's user avatar
  • 31
3 votes
0 answers
3k views

Can't bind UDP socket but port is free

I've been struggling for a while now with this so maybe someone here is able to help me. I'm setting up a CS:GO server that's going to be running on port 27059. (This is a copy&paste from a ...
sysfiend's user avatar
  • 1,407
3 votes
0 answers
576 views

Why netstat -p doesn't show PID of established connections?

I have some REST service which is listening on tcp/8051 I'm querying this service with curl in infinite loop from the same host: while true; do curl --header "Authorization: Bearer ...
user1700494's user avatar
  • 1,662
3 votes
0 answers
907 views

How to diagnose netstat: no namelist

I had to replace an NIC on my HP Proliant Microserver, running FreeNAS 9.3 In my crashplan jail, I now get "netstat: no namelist" as a response when I execute the netstat command. How to I diagnose ...
Shawn de Wet's user avatar
3 votes
0 answers
1k views

What exactly constitutes a bad TCP segment?

What constitutes a bad segment as in bad segments received in the netstat output below? I would think a TCP header's checksum could do it, but are there other things? If a segment arrives after its ...
gdw2's user avatar
  • 135
3 votes
0 answers
843 views

Why is SQL Server using all ephemeral ports connecting to itself and causing TIME_WAITs?

I've got an AWS server with Windows 2008 R2, SQL Server 2012, and Tomcat 7. When I run netstat -ano the screen is flooded with TIME_WAIT. I posted the output in a Gist. When I run CurrPorts, filter ...
jordanbtucker's user avatar
3 votes
0 answers
674 views

netstat e on windows shows really high bytes count

running netstat /e is giving me strange results "bytes received" from netstat /e output is always way higher, about 10 times higher than when netsh interface ip show subinterfaces is run. wireshark ...
ljk's user avatar
  • 131
3 votes
0 answers
1k views

Netstat Send-Q High

Am using Ubuntu Server 10.10 and when i do netstat -tuna i get the many connections with Send-Q very high, 23K, 50K, 100K. This users report that they have latency problems when connecting to the ...
Luis Alvarado's user avatar
2 votes
1 answer
3k views

Debian 8 - getnameinfo Failed Error - netstat

I am experiencing a error/warning when running any netstat command on my Debian 8 machine. One of the commands:- netstat | grep http | wc -l The result:- getnameinfo failed getnameinfo failed ...
daygle's user avatar
  • 41
2 votes
0 answers
3k views

In the output of netstat -r, what is the meaning of the "Netif" column and how does it differ to the "Gateway" column?

I can find virtually no documentation of the meaning of the column "Netif" in the output of netstat -rn. Googled for it, searched through the netstat(1) and route(8) man pages and found the following ...
papiro's user avatar
  • 159
2 votes
0 answers
533 views

How to aggregate reports given by nestat?

In this question OP gives some reports that has been generated with netstat. However, the more I look at the switches of netstat, the less I can find how to generate that report. The sample report is:...
Saeed Neamati's user avatar
2 votes
0 answers
8k views

How to resolve UDP packets being dropped given netstat reporting SndbufErrors

I have a server instance on an OpenStack that at a pretty high load starts loosing UDP packets. I captured all outgoing packets using tcpdump and some of them are missing, even though application logs ...
eddyP23's user avatar
  • 243
2 votes
0 answers
406 views

cannot bind a port altough LISTEN

I'm new to this problem I'm using Ubuntu 12.04 LTS via VMware My problem is to bind port 6703 i tried alot of commands to check if this port or open or not Error Message is Failed to bind to: 0....
user1's user avatar
  • 121
2 votes
1 answer
3k views

Netstat showing multiple connections for on ssh login

I connect to my server via ssh. I am the only person who has access to connect to the server. After connecting via ssh, I run the following command: sudo netstat -tupn The output includes the ...
flyingL123's user avatar
2 votes
2 answers
935 views

Linux: How to display all sockets opened for a particular interface?

How can I display all sockets opened for a particular interface?
user avatar
1 vote
0 answers
143 views

What does it mean when netstat outputs a dash in pid / program name column?

Here is some lightly modified output from netstat (I removed the addresses and names) a@xxxxx:/app# netstat -p Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address ...
zelinka's user avatar
  • 111
1 vote
0 answers
178 views

How to identify which os process is establishing a proxy connection

Platform: Red-Hat 7 I hope you can help me with this. I've been told that one proxy server we are using is going to be decommissioned in the following days. I've tried to use netstat in order to ...
Roberto Hernandez's user avatar
1 vote
0 answers
284 views

Get information about socket of unknown domain

The output of lsof (revision: 4.87) on centos 7.8.2003 shows: COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME java 30858 xxxx 841u sock 0,7 ...
William Pursell's user avatar
1 vote
0 answers
492 views

Iptables rule for limiting connections per ip

I'm usig the following iptable rule to limit the amount of simultaneous connections to 1 connection per ip, on port 4387. /sbin/iptables -A INPUT -p tcp --syn --dport 3387 -m connlimit --connlimit-...
NFC's user avatar
  • 11
1 vote
0 answers
437 views

IP Show on netstat -n

Could someone with more experience help me in this? I have an idea in my head and i've been trying to put it into practice. I have two machines, one where the application is hosted (I'll call it "...
Renan's user avatar
  • 11
1 vote
0 answers
75 views

Duplicate Local Port in Virtual Guest's /proc/net/tcp

I'd like to understand the following two entries in my VirtualBox's guest's /proc/net/tcp: 6: 00000000:18EB 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 9581 1 ...
jimmytann's user avatar
  • 111
1 vote
1 answer
117 views

Why is kjournald showing up 700 times in `netstat`?

AFAIK, kjournald is not a network program, but a program that deals with the journal of EXT3 (I am running EXT4 on Ubuntu 16.04). Still, when running sudo netstap -tapn it shows up almost 700 times, ...
oligofren's user avatar
  • 641
1 vote
0 answers
379 views

How to configure Linux to close the connection if Send-Q is never sent?

There is a TCP client-server connection. The application on the server is sending data regularly. Client machine is then reset physically. Netstat shows Send-Q on the server is filling up, the ...
Velkan's user avatar
  • 364
1 vote
0 answers
38 views

netstats shows my own server is hitting a server its not supposed to know about

On AWS I have a few dedicated servers that do image processing, and they seem to get high traffic and fail. When running netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n I ...
Niro's user avatar
  • 1,451
1 vote
0 answers
3k views

Synology open for Cloud Station even if blocking 6690 port

I have a NAS Synology beyong my Internet Box. On the Internet Box, I have UPnP not activated and I have only activated on Port Transfer the following ports : 1701/UDP, 500/UDP and 4500/UDP which are ...
Alexis G's user avatar
  • 121
1 vote
2 answers
146 views

See stats of data in and out of each connection to a port

I have an application listening to a port. The clients connect to it using http connection. At any given time I see around 3000 connections established. I assume not all these connections are in use (...
Amod Pandey's user avatar
1 vote
0 answers
1k views

TCP High Send-q coupled with FIN_WAIT1 status

I'm having a problem with one of my webservers, which is taking minutes to completely render a web page. I had a look at the TCP connection and noticed that I have a very high value in the send-q ...
StephenC's user avatar
1 vote
0 answers
311 views

How to check a given connection has been offloaded to network card

From what I read, some part of the tcp protocol operation can be offloaded from kernel to network card driver thanks to TOE (or GSO, LSO, LRO..). My objective is too find if a given socket has some ...
kamaradclimber's user avatar
1 vote
0 answers
1k views

iptables traffic after forwarding

I have 2 servers Server A and Server B ServerA = 1.1.1.1 ServerB = 2.2.2.2 I am using ip-tables to send all traffic on port 80 to Server B on Server (A) 1.1.1.1 i have done iptables -t nat -A ...
Ra Fay's user avatar
  • 21
1 vote
0 answers
986 views

Ghost tcp connections: ss sees them, nothing else does

We have a strange problem. Our remote server shows over 900 connections coming from our office over port 80: # ss -n | grep ESTAB | grep $OFFICEIP | grep :80 | wc -l 935 Netstat shows a similar ...
Mediocre Gopher's user avatar
1 vote
3 answers
4k views

Limit Number of TCP connections in Linux Server, to avoid attack

I want to limit the number of TCP connections in Linux server, I have used the following command. iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 25 --connlimit-mask 32 -...
Mani's user avatar
  • 215
1 vote
1 answer
1k views

Apache2 many CLOSE_WAIT. LAMP. Locating the issue

I've got a LAMP setup running and I seem to have many CLOSE_WAIT connections for apache2 program when I netstat (several hundred). This eventually causes my apache to become unresponsive. Bellow is ...
D.Mill's user avatar
  • 379
1 vote
1 answer
219 views

Confusing traffic in netstat, nothing in logs

Just had a confusing couple of minutes! I was monitoring a screen (the gnu screen) running "netstat -a" and I noticed that there was one connection connected to http (port 80), fine. But when I ...
Armer's user avatar
  • 11
1 vote
1 answer
710 views

nginx serving .php as static files

ok, again apparently a totally ridiculous problem which I just can't seem to figure out. nginx keeps serving my .php files as static files. I've installed nginx via the repositories on ubuntu. I've ...
jcfrei's user avatar
  • 175
1 vote
1 answer
252 views

Netstat flags on OS/2

On an OS/2 box, what do the flags UGDP mean in the output of netstat -r. Google seems to point to them meaning Up, Gateway (i.e. an indirect root), and Dynamic (learned from a redirect), but that ...
Cian's user avatar
  • 5,858
1 vote
1 answer
4k views

Lots of TIME_WAIT from same IP address

I've seen a lot of questions with people concerned about lots of TIME_WAITs in netstat. I'm having a similar problem but all the TIME_WAITs are coming from the same IP address. I get over 200 of the ...
user213510's user avatar
0 votes
0 answers
53 views

Difference Send-Q between netstat and ss

The ss send-Q column shows non-zero value constantly, while netstat shows Send-Q as zero for same port and same process. Can you please let me know why like this and what does mean by non-zero value. ...
Rama's user avatar
  • 39
0 votes
0 answers
85 views

Martian packet with ARP broadcast traffic

Server nodes keep getting ARP broadcast traffic and becoming martian packets due to assymatric routing. I was known that when strict filtering is enabled with net.ipv4.conf.eth0.rp_filter = 1, the ...
Rama's user avatar
  • 39
0 votes
0 answers
82 views

PHP Error waiting on socket

I'm getting problems with ssh2 and fread php function that started on a few days. On the apache error log show: ssh2_connect(): Error starting up SSH connection(-9): Error waiting on socket fread(): ...
user1505698's user avatar
0 votes
0 answers
39 views

fuser not listing the process even netstat and lsof list

hostserver:~# lsof | grep *:6343 sflowtool 979324 root 3u IPv6 1443815323 0t0 UDP *:6343 hostserver:~# netstat -ntlup | grep 6343 udp6 0 ...
Ujjwal Gupta's user avatar
0 votes
0 answers
119 views

Can't create a pseudo network interface on Debian 11

I have a KVM based Debian 11 (bullseye) VPS with internet access on eth0 network adapter. The public IP has been assigned by DHCP. The IPs and Routes are as what follows: ifconfig and iptable BEFORE ...
Mohamad Reza's user avatar
0 votes
1 answer
405 views

NetStat Group By Process Id and Show Count

Is there any way to group the output given by netstat into process? I am running netstat -ano and doing manual count to know which process is using how many ports. I am using Windows Server. We have ...
Imran Qadir Baksh - Baloch's user avatar
0 votes
0 answers
191 views

how to continues netstat a port and save it to text file with time stamp for each netstat

I am using a system which is integrated to other system using a specific port and recently I am facing multiple interruption in the integration, and I need to monitor the port "48823" for a ...
Hossam M's user avatar
0 votes
0 answers
558 views

Why NFS is listening to a port but not showing the process name, is there any security risk if no firewall is set?

I'm using ubuntu 22.04 and have mounted an NFS storage, here is my fstab file ftpback-bhs5-26.ip-149-56-30.net:/export/ftpbackup/ns524316.ip-xxx-xxx-xxx.net /media/backup nfs vers=4.0 0 0 When ...
maP1E bluE's user avatar
0 votes
1 answer
1k views

Nginx change default IP form 0.0.0.0 to pecific IP

I have nginx running as a web server. The virtual host have the IP specific configuration with IP addresses listed, however whtn I check netstat Nginx is litening on 0.0.0.0:80. I would like to change ...
Tibby's user avatar
  • 215
0 votes
0 answers
311 views

How to block flooding "empty" connections from single IP

Right now netstat lists 200 - 4000 connections to the same IP in India. Seems like some kind of flooding attack to me. e.g: tcp 0 0 [removed] 182.65.238.[removed].in-:mysql TIME_WAIT I've ...
jan's user avatar
  • 1
0 votes
0 answers
103 views

Showing all http connections in vm instance

I have a Google Cloud VM instance running Debian and a dockerized Apache httpd inside. I'm trying to count all the http connections in the machine. I run this: for i in {1..1000}; do netstat -at | wc -...
Héctor's user avatar
  • 187