netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

4
votes
2answers
512 views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
1
vote
2answers
358 views

Linux: How to display all sockets opened for a particular interface?

How can I display all sockets opened for a particular interface?
0
votes
2answers
68 views

What are records in 'netstat' command are when using logstash?

I use logstash with embedded elasticsearch. My logstash config looks like the following: output { tdout { debug => true debug_format => "json"} elasticsearch { embedded => true ...
3
votes
1answer
613 views

Where are my TIME_WAITs on Mac OS X?

No TIME_WAITs on Mac OS X Normally, when a TCP connection is closed, the socket on the side where close() is called first is left in the TIME_WAIT state. When one of the peers is a Mac OS X (Lion) ...
1
vote
1answer
153 views

Lots of TIME_WAIT from same IP address

I've seen a lot of questions with people concerned about lots of TIME_WAITs in netstat. I'm having a similar problem but all the TIME_WAITs are coming from the same IP address. I get over 200 of the ...
1
vote
1answer
131 views

Confusing traffic in netstat, nothing in logs

Just had a confusing couple of minutes! I was monitoring a screen (the gnu screen) running "netstat -a" and I noticed that there was one connection connected to http (port 80), fine. But when I ...
1
vote
1answer
439 views

nginx serving .php as static files

ok, again apparently a totally ridiculous problem which I just can't seem to figure out. nginx keeps serving my .php files as static files. I've installed nginx via the repositories on ubuntu. I've ...
1
vote
1answer
477 views

netstat -e: high discards and errors

I think my network is congested because of the relatively large discards and errors data. They should be zero or at least close to that. Here is the output of netstat -e on my computer: Interface ...
1
vote
1answer
184 views

Netstat flags on OS/2

On an OS/2 box, what do the flags UGDP mean in the output of netstat -r. Google seems to point to them meaning Up, Gateway (i.e. an indirect root), and Dynamic (learned from a redirect), but that ...
0
votes
1answer
24 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk ...
0
votes
1answer
333 views

UDP port appears to be in use but is not shown in netstat or TCPView

I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen ...
0
votes
1answer
216 views

how to display netstat output on nagios

Can you please tell me how to monitor an established connection (on a specified port) in a windows machine from nagios (centOS) here an example (output of netstat): Proto Local Address ...
0
votes
1answer
72 views

Strange ports on default install of W7

I have a base new install of windows 7, and when I went to look for something else I saw the attached netstat output. What concerns me is that this is Windows + Truecrypt + drivers, nothing else ...
0
votes
1answer
166 views

Apache2 many CLOSE_WAIT. LAMP. Locating the issue

I've got a LAMP setup running and I seem to have many CLOSE_WAIT connections for apache2 program when I netstat (several hundred). This eventually causes my apache to become unresponsive. Bellow is ...
0
votes
1answer
285 views

How to check if sockets are sending/receiving data on linux?

I often have to debug processes which involve a server client tcp connection. I'd like to check, during times where a client might seem stuck, whether the server is sending it data or not. I can use: ...
0
votes
1answer
148 views

How can I find the cause of an unknown connection showing in iftop?

I have connections like this showing frequently in iftop: 12.15.127.75.host.nwnx.net => 121.61.153.172 480b 160b 40b I have no idea ...
0
votes
1answer
315 views

Apache creates lots of processes in CLOSE_WAIT state and than crashes

I have a web server (centos) with Apache 2.4.3 and in peak times Apache becomes unresponsive until I restart it. Before it happens there is suddenly spike of httpd proccesses count and it seems that ...
0
votes
1answer
160 views

ss utility does't work properly

I've learned that ss, which is base on netlink, is much faster than netstat when amount of sockets is large. And the secret is here. But when I tested on my suse linux minutes ago, the result ...
0
votes
1answer
240 views

fast opening and closing connection with a specific port

We have a Main application named "Trevor" installed in 2008R2 machine named "TEAMER12" which is slow now. One more application named "TVS" also running in and found there were many connections per ...
0
votes
1answer
604 views

FileMaker Server not listening on Port 2399 for ODBC/JDBC

I am trying to create a ODBC connection from an OSX machine to a Filemaker server 10 using a DataDirect SeQuel Link 5.5 JDBC drive. I have ODBC/JDBC enabled on the server and I followed all of the ...
2
votes
0answers
515 views

Netstat Send-Q High

Am using Ubuntu Server 10.10 and when i do netstat -tuna i get the many connections with Send-Q very high, 23K, 50K, 100K. This users report that they have latency problems when connecting to the ...
1
vote
0answers
216 views

What does “connections reset due to unexpected data” in netstat -s mean

I'm running a memcached server under heavy load from multiple web servers. While investigating some odd app level behaviour, we spotted that netstat -s on the memcached box was showing a lot of ...
1
vote
0answers
192 views

how to get send-q and receive-q on windows server

in linux, is very easy to troubleshoot a remote connection problem because netstat show the send-q and recv-q. This is very useful because we can know if the remote peer is reading the server send ...
1
vote
0answers
432 views

High count packets rejects in established connections because of timestamp

I am trying to set up a Wowza media server using a Dell R710 with 24GB memory and a 10Gbit connection and all the calculations say it should be able to handle around 20k connections however when I get ...
0
votes
0answers
56 views

netstat ? Huge buffer build-up

we are seeing the following: The netstat line which shows the buildup: 10:51:34|tcp 4294967258 0 192.20.1.228:53824 192.20.1.228:2500 ESTABLISHED The netstat command used to generate the ...
0
votes
0answers
72 views

How can I use “show netstat” on a Sonicwall NSA 2400 correctly?

I have a SonicWALL NSA 2400 and I would like to view statistics on open connections. It seems there is a netstat command available via the serial console but It doesn't seem to work correctly. Once ...
0
votes
0answers
195 views

What does given filed mean in netstat -s on Linux

I am analyzing the the output of netstat -s and wanted to know what "input ICMP message failed" is meant for ,below is output of netstat -s Icmp: 643 ICMP messages received 0 input ICMP ...