netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

4
votes
2answers
783 views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
1
vote
2answers
372 views

Linux: How to display all sockets opened for a particular interface?

How can I display all sockets opened for a particular interface?
0
votes
2answers
163 views

What are records in 'netstat' command are when using logstash?

I use logstash with embedded elasticsearch. My logstash config looks like the following: output { tdout { debug => true debug_format => "json"} elasticsearch { embedded => true ...
3
votes
1answer
702 views

Where are my TIME_WAITs on Mac OS X?

No TIME_WAITs on Mac OS X Normally, when a TCP connection is closed, the socket on the side where close() is called first is left in the TIME_WAIT state. When one of the peers is a Mac OS X (Lion) ...
1
vote
1answer
352 views

Lots of TIME_WAIT from same IP address

I've seen a lot of questions with people concerned about lots of TIME_WAITs in netstat. I'm having a similar problem but all the TIME_WAITs are coming from the same IP address. I get over 200 of the ...
1
vote
1answer
134 views

Confusing traffic in netstat, nothing in logs

Just had a confusing couple of minutes! I was monitoring a screen (the gnu screen) running "netstat -a" and I noticed that there was one connection connected to http (port 80), fine. But when I ...
1
vote
1answer
462 views

nginx serving .php as static files

ok, again apparently a totally ridiculous problem which I just can't seem to figure out. nginx keeps serving my .php files as static files. I've installed nginx via the repositories on ubuntu. I've ...
1
vote
1answer
549 views

netstat -e: high discards and errors

I think my network is congested because of the relatively large discards and errors data. They should be zero or at least close to that. Here is the output of netstat -e on my computer: Interface ...
1
vote
1answer
185 views

Netstat flags on OS/2

On an OS/2 box, what do the flags UGDP mean in the output of netstat -r. Google seems to point to them meaning Up, Gateway (i.e. an indirect root), and Dynamic (learned from a redirect), but that ...
0
votes
1answer
43 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk ...
0
votes
1answer
734 views

UDP port appears to be in use but is not shown in netstat or TCPView

I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen ...
0
votes
1answer
278 views

how to display netstat output on nagios

Can you please tell me how to monitor an established connection (on a specified port) in a windows machine from nagios (centOS) here an example (output of netstat): Proto Local Address ...
0
votes
1answer
78 views

Strange ports on default install of W7

I have a base new install of windows 7, and when I went to look for something else I saw the attached netstat output. What concerns me is that this is Windows + Truecrypt + drivers, nothing else ...
0
votes
1answer
200 views

Apache2 many CLOSE_WAIT. LAMP. Locating the issue

I've got a LAMP setup running and I seem to have many CLOSE_WAIT connections for apache2 program when I netstat (several hundred). This eventually causes my apache to become unresponsive. Bellow is ...
0
votes
1answer
419 views

How to check if sockets are sending/receiving data on linux?

I often have to debug processes which involve a server client tcp connection. I'd like to check, during times where a client might seem stuck, whether the server is sending it data or not. I can use: ...
0
votes
1answer
165 views

How can I find the cause of an unknown connection showing in iftop?

I have connections like this showing frequently in iftop: 12.15.127.75.host.nwnx.net => 121.61.153.172 480b 160b 40b I have no idea ...
0
votes
1answer
443 views

Apache creates lots of processes in CLOSE_WAIT state and than crashes

I have a web server (centos) with Apache 2.4.3 and in peak times Apache becomes unresponsive until I restart it. Before it happens there is suddenly spike of httpd proccesses count and it seems that ...
0
votes
1answer
160 views

ss utility does't work properly

I've learned that ss, which is base on netlink, is much faster than netstat when amount of sockets is large. And the secret is here. But when I tested on my suse linux minutes ago, the result ...
0
votes
1answer
263 views

fast opening and closing connection with a specific port

We have a Main application named "Trevor" installed in 2008R2 machine named "TEAMER12" which is slow now. One more application named "TVS" also running in and found there were many connections per ...
0
votes
1answer
654 views

FileMaker Server not listening on Port 2399 for ODBC/JDBC

I am trying to create a ODBC connection from an OSX machine to a Filemaker server 10 using a DataDirect SeQuel Link 5.5 JDBC drive. I have ODBC/JDBC enabled on the server and I followed all of the ...
2
votes
0answers
540 views

Netstat Send-Q High

Am using Ubuntu Server 10.10 and when i do netstat -tuna i get the many connections with Send-Q very high, 23K, 50K, 100K. This users report that they have latency problems when connecting to the ...
1
vote
0answers
367 views

What does “connections reset due to unexpected data” in netstat -s mean

I'm running a memcached server under heavy load from multiple web servers. While investigating some odd app level behaviour, we spotted that netstat -s on the memcached box was showing a lot of ...
1
vote
0answers
218 views

how to get send-q and receive-q on windows server

in linux, is very easy to troubleshoot a remote connection problem because netstat show the send-q and recv-q. This is very useful because we can know if the remote peer is reading the server send ...
1
vote
0answers
489 views

High count packets rejects in established connections because of timestamp

I am trying to set up a Wowza media server using a Dell R710 with 24GB memory and a 10Gbit connection and all the calculations say it should be able to handle around 20k connections however when I get ...
0
votes
0answers
8 views

xinetd stops working in Debian Wheezy

We have a server with a whois service running. The whois service is provided by xinetd. The configuration file /etc/xinetd.d/whois looks like this: service whois { socket_type = stream ...
0
votes
0answers
59 views

Netstat count TIME_WAIT connections by port

I can obtain individual TIME_WAIT counts on a port, netstat -nat | grep :11300 | grep TIME_WAIT | wc -l; but how to do this based on all ports eg: 11300 2900 connection 3306 1200 connection ...
0
votes
0answers
39 views

netstat e on windows shows really high bytes count

running netstat /e is giving me strange results "bytes received" from netstat /e output is always way higher, about 10 times higher than when netsh interface ip show subinterfaces is run. wireshark ...
0
votes
0answers
641 views

Windows TCP Port 139 Netbios-ssn vulnerability

I ran netstat -b on my computer. Two results showed that I do not understand, VAIO being another PC on the LAN. [firefox.exe] TCP 192.168.100.106:49186 VAIO:netbios-ssn TIME_WAIT TCP ...
0
votes
0answers
213 views

What does given filed mean in netstat -s on Linux

I am analyzing the the output of netstat -s and wanted to know what "input ICMP message failed" is meant for ,below is output of netstat -s Icmp: 643 ICMP messages received 0 input ICMP ...