netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

8
votes
2answers
1k views

Where are my TIME_WAITs on Mac OS X?

No TIME_WAITs on Mac OS X Normally, when a TCP connection is closed, the socket on the side where close() is called first is left in the TIME_WAIT state. When one of the peers is a Mac OS X (Lion) ...
3
votes
2answers
4k views

UDP port appears to be in use but is not shown in netstat or TCPView

I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen ...
1
vote
2answers
46 views

See stats of data in and out of each connection to a port

I have an application listening to a port. The clients connect to it using http connection. At any given time I see around 3000 connections established. I assume not all these connections are in use (...
1
vote
2answers
471 views

Linux: How to display all sockets opened for a particular interface?

How can I display all sockets opened for a particular interface?
1
vote
1answer
237 views

Netstat showing multiple connections for on ssh login

I connect to my server via ssh. I am the only person who has access to connect to the server. After connecting via ssh, I run the following command: sudo netstat -tupn The output includes the ...
1
vote
1answer
216 views

Limit Number of TCP connections in Linux Server, to avoid attack

I want to limit the number of TCP connections in Linux server, I have used the following command. iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 25 --connlimit-mask 32 -...
1
vote
1answer
1k views

Lots of TIME_WAIT from same IP address

I've seen a lot of questions with people concerned about lots of TIME_WAITs in netstat. I'm having a similar problem but all the TIME_WAITs are coming from the same IP address. I get over 200 of the ...
1
vote
1answer
173 views

Confusing traffic in netstat, nothing in logs

Just had a confusing couple of minutes! I was monitoring a screen (the gnu screen) running "netstat -a" and I noticed that there was one connection connected to http (port 80), fine. But when I ...
1
vote
1answer
552 views

nginx serving .php as static files

ok, again apparently a totally ridiculous problem which I just can't seem to figure out. nginx keeps serving my .php files as static files. I've installed nginx via the repositories on ubuntu. I've ...
1
vote
1answer
1k views

netstat -e: high discards and errors

I think my network is congested because of the relatively large discards and errors data. They should be zero or at least close to that. Here is the output of netstat -e on my computer: Interface ...
1
vote
1answer
200 views

Netstat flags on OS/2

On an OS/2 box, what do the flags UGDP mean in the output of netstat -r. Google seems to point to them meaning Up, Gateway (i.e. an indirect root), and Dynamic (learned from a redirect), but that ...
0
votes
1answer
41 views

Irresponsive nginx while doing “nginx reload”

While reloading nginx, I started getting errors in messages log "possible SYN flooding on port 443", and it seems like nginx becomes completely irresponsive at that time (quite for a while), cause ...
0
votes
1answer
15 views

PID 4 Using Port 80 - IIS Unable To Bind

So I've been having a problem where I can't use localhost:80 on IIS So I ran this: > netstat -ano | find "0:80" And got: TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 ...
0
votes
1answer
35 views

Netcat - socket in time_wait when echoing and piping, but not when invoked directly

I'm testing an application using netcat (nc) and I'm getting very low throughput on network connections. When I ran netstat -tnpo I see numerous TCP sessions in TIME_WAIT. I'm sending data to my ...
0
votes
1answer
98 views

Concurrent connections per IP

I need to make a few changes to a firewall configuration, but before I do I'd like to see the number of concurrent Apache connections per IP. This command produces a nice list: #netstat -ntu | awk '{...
0
votes
1answer
83 views

Simulation of TX/RX Drop

I'm trying to get the "TX/RX Drop" values to increase. I've tried dropping packets using both iperf and iptables but the statistics aren't increasing even when packets are being dropped. Is there a ...
0
votes
1answer
150 views

Port 80 doesn't work

I have a website in my ubuntu server 14.04, with apache2 server, and untils fews days go the site works fine but, today if I digit www.mydomain.com from my internal network it works but, if I try with ...
0
votes
1answer
509 views

how to display netstat output on nagios

Can you please tell me how to monitor an established connection (on a specified port) in a windows machine from nagios (centOS) here an example (output of netstat): Proto Local Address ...
0
votes
1answer
115 views

Strange ports on default install of W7

I have a base new install of windows 7, and when I went to look for something else I saw the attached netstat output. What concerns me is that this is Windows + Truecrypt + drivers, nothing else ...
0
votes
1answer
315 views

Apache2 many CLOSE_WAIT. LAMP. Locating the issue

I've got a LAMP setup running and I seem to have many CLOSE_WAIT connections for apache2 program when I netstat (several hundred). This eventually causes my apache to become unresponsive. Bellow is ...
0
votes
1answer
295 views

How can I find the cause of an unknown connection showing in iftop?

I have connections like this showing frequently in iftop: 12.15.127.75.host.nwnx.net => 121.61.153.172 480b 160b 40b I have no idea ...
0
votes
1answer
940 views

Apache creates lots of processes in CLOSE_WAIT state and than crashes

I have a web server (centos) with Apache 2.4.3 and in peak times Apache becomes unresponsive until I restart it. Before it happens there is suddenly spike of httpd proccesses count and it seems that ...
0
votes
1answer
176 views

ss utility does't work properly

I've learned that ss, which is base on netlink, is much faster than netstat when amount of sockets is large. And the secret is here. But when I tested on my suse linux minutes ago, the result ...
0
votes
1answer
457 views

fast opening and closing connection with a specific port

We have a Main application named "Trevor" installed in 2008R2 machine named "TEAMER12" which is slow now. One more application named "TVS" also running in and found there were many connections per ...
0
votes
1answer
995 views

FileMaker Server not listening on Port 2399 for ODBC/JDBC

I am trying to create a ODBC connection from an OSX machine to a Filemaker server 10 using a DataDirect SeQuel Link 5.5 JDBC drive. I have ODBC/JDBC enabled on the server and I followed all of the ...
4
votes
0answers
747 views

What does “connections reset due to unexpected data” in netstat -s mean

I'm running a memcached server under heavy load from multiple web servers. While investigating some odd app level behaviour, we spotted that netstat -s on the memcached box was showing a lot of "...
2
votes
0answers
234 views

How to resolve UDP packets being dropped given netstat reporting SndbufErrors

I have a server instance on an OpenStack that at a pretty high load starts loosing UDP packets. I captured all outgoing packets using tcpdump and some of them are missing, even though application logs ...
2
votes
0answers
57 views

cannot bind a port altough LISTEN

I'm new to this problem I'm using Ubuntu 12.04 LTS via VMware My problem is to bind port 6703 i tried alot of commands to check if this port or open or not Error Message is Failed to bind to: 0....
2
votes
0answers
145 views

Why is SQL Server using all ephemeral ports connecting to itself and causing TIME_WAITs?

I've got an AWS server with Windows 2008 R2, SQL Server 2012, and Tomcat 7. When I run netstat -ano the screen is flooded with TIME_WAIT. I posted the output in a Gist. When I run CurrPorts, filter ...
2
votes
0answers
702 views

Netstat Send-Q High

Am using Ubuntu Server 10.10 and when i do netstat -tuna i get the many connections with Send-Q very high, 23K, 50K, 100K. This users report that they have latency problems when connecting to the ...
1
vote
0answers
24 views

Why netstat -p doesn't show PID of established connections?

I have some REST service which is listening on tcp/8051 I'm querying this service with curl in infinite loop from the same host: while true; do curl --header "Authorization: Bearer ...
1
vote
0answers
21 views

How to aggregate reports given by nestat?

In this question OP gives some reports that has been generated with netstat. However, the more I look at the switches of netstat, the less I can find how to generate that report. The sample report is:...
1
vote
0answers
139 views

How to diagnose netstat: no namelist

I had to replace an NIC on my HP Proliant Microserver, running FreeNAS 9.3 In my crashplan jail, I now get "netstat: no namelist" as a response when I execute the netstat command. How to I diagnose ...
1
vote
0answers
78 views

What exactly constitutes a bad TCP segment?

What constitutes a bad segment as in bad segments received in the netstat output below? I would think a TCP header's checksum could do it, but are there other things? If a segment arrives after its ...
1
vote
0answers
264 views

TCP High Send-q coupled with FIN_WAIT1 status

I'm having a problem with one of my webservers, which is taking minutes to completely render a web page. I had a look at the TCP connection and noticed that I have a very high value in the send-q ...
1
vote
0answers
71 views

How to check a given connection has been offloaded to network card

From what I read, some part of the tcp protocol operation can be offloaded from kernel to network card driver thanks to TOE (or GSO, LSO, LRO..). My objective is too find if a given socket has some ...
1
vote
0answers
168 views

iptables traffic after forwarding

I have 2 servers Server A and Server B ServerA = 1.1.1.1 ServerB = 2.2.2.2 I am using ip-tables to send all traffic on port 80 to Server B on Server (A) 1.1.1.1 i have done iptables -t nat -A ...
1
vote
0answers
364 views

how to get send-q and receive-q on windows server

in linux, is very easy to troubleshoot a remote connection problem because netstat show the send-q and recv-q. This is very useful because we can know if the remote peer is reading the server send ...
0
votes
0answers
24 views

IIS6 - localhost/MachineName IP/Ports configuration Error after system crash and Restore

Six months ago my hosted win 2003 server crashed due to RAID drive issues while at the datacentre and I lost my installation. After a re-install I recovered my websites, (with help .. approx. 10) and ...
0
votes
0answers
11 views

netstats shows my own server is hitting a server its not supposed to know about

ON AWS I have a few dedicated servers that do image processing and they seem to get high traffic and fail. when running netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n I ...
0
votes
0answers
33 views

netstat result showing syn sent for specific ip (local) which is not exist in LAN

I was using my web server (jboss) in different subnet (192.168.150.10/24) and after sometime, just changed to another subnet (192.168.200.20/24). But still i could see in netstat -pnt result, my new ...
0
votes
0answers
402 views

Weird CLOSE_WAIT statuses at standard PHP application

I am asking for help regarding tcp problems on a webserver serving a web application built in PHP. The client is a standard html/js page viewed in the web browser. This client sends Ajax requests ...
0
votes
0answers
53 views

What does `SYNs to LISTEN sockets dropped` from `netstat -s` mean

I could found 437 SYNs to LISTEN sockets dropped from netstat -s from the server on my server which runs nginx. I found this explanation from the man page: --statistics, -s, Display summary ...
0
votes
0answers
23 views

netstat -r on debian give abnormal output

after looking for stuff with Debian "netstat" and try list stuff with "nestat -r" my main Server out a Long list of unkown Hosts ( mostly hacked IP´s by looking on abuseDB ) here a small example for ...
0
votes
0answers
173 views

IPA Server installation: Error with port number

When I am trying to install IPA server, I am getting the following error : IPA requires port 8443 for PKI but it is currently in use. Aborting installation I checked with netstat -tuplen | grep ...
0
votes
0answers
908 views

Synology open for Cloud Station even if blocking 6690 port

I have a NAS Synology beyong my Internet Box. On the Internet Box, I have UPnP not activated and I have only activated on Port Transfer the following ports : 1701/UDP, 500/UDP and 4500/UDP which are ...
0
votes
0answers
289 views

No connection available in pool. netstat RecvQ shows high number

In our servers there is one particular dependency (java jar), which makes a total of 1024 connection to various remote servers (the library works as a service discovery). Intermittently, it is ...
0
votes
0answers
204 views

Ghost tcp connections: ss sees them, nothing else does

We have a strange problem. Our remote server shows over 900 connections coming from our office over port 80: # ss -n | grep ESTAB | grep $OFFICEIP | grep :80 | wc -l 935 Netstat shows a similar ...
0
votes
0answers
217 views

netstat e on windows shows really high bytes count

running netstat /e is giving me strange results "bytes received" from netstat /e output is always way higher, about 10 times higher than when netsh interface ip show subinterfaces is run. wireshark ...
0
votes
0answers
4k views

Windows TCP Port 139 Netbios-ssn vulnerability

I ran netstat -b on my computer. Two results showed that I do not understand, VAIO being another PC on the LAN. [firefox.exe] TCP 192.168.100.106:49186 VAIO:netbios-ssn TIME_WAIT TCP 192.168.100....