netstat is a tool for viewing active network connections, listeners and sockets.

learn more… | top users | synonyms

61
votes
4answers
64k views

What's the difference between ip address 0.0.0.0 and 127.0.0.1?

I do know that 127.0.0.1 ~ 127.255.255.254 are the loopback IP addresses for most modern operating systems and we could use these IP addresses to refer to our own computer. But what's 0.0.0.0? It ...
15
votes
4answers
13k views

How to find other end of unix socket connection?

I have a process (dbus-daemon) which has many open connection over UNIX sockets. One of these connections is fd #36: =$ ps uw -p 23284 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME ...
12
votes
5answers
57k views

Huge amount of TIME_WAIT connections says netstat

Okay, this is creeping me out - I see about 1500-2500 of these: root@wherever:# netstat Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 ...
9
votes
4answers
23k views

How do I make cURL use keepalive from the command line?

I'm trying to verify that HTTP persistent connections are being used during communication with a Tomcat webserver I've got running. Currently, I can retrieve a resource on my server from a browser ...
9
votes
7answers
26k views

How do I get rid of sockets in FIN_WAIT1 state?

I have a port that is blocked by a process I needed to kill. (a little telnet daemon that crashed) The process was killed successfully but the port is still in a 'FIN_WAIT1' state. It doesn't come out ...
8
votes
6answers
5k views

netstat shows a listening port with no pid but lsof does not

This question is similar to Network port open, but no process attached? I've tried everything from there, reviewed the logs, etc... and can't find anything. My netstat shows a TCP listening port and ...
7
votes
3answers
5k views

TIME_WAIT connections not being cleaned up after timeout period expires

I am stress testing one of my servers by hitting it with a constant stream of new network connections, the tcp_fin_timeout is set to 60, so if I send a constant stream of something like 100 requests ...
7
votes
3answers
14k views

netstat -ntap doesn't show pid/process name for some connections?

I have ubuntu/hardy server, with kernel 2.6.24-23-server and netstat: # netstat --version net-tools 1.60 netstat 1.42 (2001-04-15) The problem is that we have a lot of ESTABLISHED connections that ...
6
votes
3answers
2k views

Semantics of :: and 0.0.0.0 in dual-stack OSes

Back in the IPv4-only days, a LISTEN connection showing in netstat as listening on 0.0.0.0 would respond to connections on any IPv4 interface in the system. As I understand it, the new IPv6 idiom :: ...
6
votes
4answers
2k views

TCP monitoring on a server: comparing netstat vs lsof?

I'm monitoring the TCP stack on a server hoping to generically infer problems with application on the box. My first inclination is to measure the number of sockets in all reported states ...
5
votes
3answers
2k views

In the output for netstat what does the [::] mean?

In the results for netstat what does the [::] mean? example [::]:ssh [::]:* LISTEN
5
votes
4answers
11k views

Running lsof -i shows a lot of connections in CLOSE_WAIT ? Should I worry

So I am running lsof -i | wc -l periodically and it is telling me that out of 420 lines, between 240 and 255 are in CLOSE_WAIT state. How does TCP connections enter this state ? Should I be worried ...
5
votes
1answer
524 views

Why is rpc.lockd obscured from netstat/lsof output?

Prologue: On a number of machines, which happen to act as NFS clients, netstat reports two ports that are open with no PID listed for an associated daemon. Ordinarily this might be a bit concerning. ...
5
votes
3answers
6k views

How to kill a TCP connection using tcpkill utility

I'm trying to kill an ESTABLISHED TCP connection using tcpkill. The connection is an open HTTPS connection. It appears on netstat as: tcp 0 0 X.X.X.X:55601 X.X.X.X:https ...
4
votes
2answers
4k views

lots of packets pruned and packets collapsed because of socket buffer low/overrun

i've set up a test machine (debian squeeze 2.6.32 on a linode 2048 machine) that interact with an api that returns large chunks of json. It calls the API 3000/minutes asynchronously, the api is ...
4
votes
2answers
723 views

How to know which process was using a port after it enters TIME_WAIT state?

On Linux, is there a way to figure out what process was using a port, before it went into TIME_WAIT state. When I use netstat -tnp I just see two end points, but no process information. Proto Recv-Q ...
4
votes
3answers
239 views

Windows Server 2008/2003 - determine all “used” local network ports

I have been tasked with enabling the local firewall on 100+ servers. The systems are running many different applications using many different ports. I began with an nmap scan, but without going to ...
4
votes
2answers
685 views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
3
votes
5answers
5k views

Network port open, but no process attached?

I have a weird situation going on with an open network port. My main question is, why would there not be a program associated with an open TCP port: netstat -ln --program Active Internet connections ...
3
votes
7answers
19k views

Port 80 is being used by SYSTEM (PID 4), what is that?

I am trying to use port 80 for my application server, but when I perform "netstat -aon" I get TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 When I look up the process in ...
3
votes
2answers
2k views

How to determine which TCP/UDP ports are being opened by a given process (linux)?

I know how to do the opposite (find out what process has a given port open) using lsof or netstat, but extensive research on Google hasn't helped me solve the reverse problem. I know I could use ...
3
votes
2answers
1k views

linux : netstat listeting queue length

Is there a way to view queue length on listening socket under linux, the same way as netstat -L outputs for freebsd? I.e. you can see X/Y/Z in netstat -L output, but netstat under linux doesn't ...
3
votes
2answers
159 views

After kill -9 process won't disappear and port is still bound

We have a Java server application running on Mac OS X. Occasionally this application has become unresponsive, and we have resorted to killing it with kill -9. However, the process doesn't disappear; ...
3
votes
1answer
274 views

AIX: is it somehow possible to get a ForeignAddress/PID pair like we are able to get in Linux with netstat?

In Linux (RHEL), we are able to get a ForeignAddress/PID pair with "netstat -ntp" command: [root@rhel ~]# netstat -ntp Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address ...
3
votes
1answer
3k views

Port 80 being used by Microsoft-HTTPAPI/2.0

It's been quite a few days that port is being used by some strange process which i don't know Initially i thought it's related to SQL Server. I tried stopping all the services which starts from SQL ...
3
votes
1answer
509 views

Interpreting Netstat output

I have a LAMP stack running Fedora 12 and I am run the following instruction through the command line on the server: netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | ...
3
votes
1answer
95 views

What is a good way to determine a server's connection usage?

Trying to figure out where my system's connections are being used (i.e. how many connections belong to what processes - could even be filtered by some expression through grep, if it applies). The ...
3
votes
2answers
2k views

netstat and ip_conntrack connection count differ by order of magnitude. Why?

in /proc/net/ip_conntrack I have: established 3076 time_wait 4346 total 7468 and in netstat I have: established 1051 time_wait 73 total 1165 Why is that? Where are other connections? How to ...
3
votes
2answers
1k views

What does each field of netstat -ano mean?

tcp 0 0 219.155.32.195:8888 221.137.227.51:5943 TIME_WAIT timewait (58.45/0/0) tcp 0 0 219.155.32.195:8888 221.137.227.51:5936 TIME_WAIT timewait ...
3
votes
3answers
610 views

python reports socket in use, netstat and others claim its not

We have a strange socket issue with a RHES3 box: Python 2.4.1 (#1, Jul 5 2005, 19:17:11) [GCC 3.2.3 20030502 (Red Hat Linux 3.2.3-52)] Type "help", "copyright", "credits" or "license" for more ...
3
votes
1answer
675 views

Where are my TIME_WAITs on Mac OS X?

No TIME_WAITs on Mac OS X Normally, when a TCP connection is closed, the socket on the side where close() is called first is left in the TIME_WAIT state. When one of the peers is a Mac OS X (Lion) ...
2
votes
2answers
158 views

What does “::” denote in windows netstat results?

I'm trying to understand on which interfaces a TCP port is open Using windows netstat command I get result like : TCP [::]:10000 MyMachineName:0 LISTENING What does ...
2
votes
1answer
3k views

Netstat continuous refresh (watch changes the output)

I am using this simple command to monitor connections (to deal with some recent DOS attacks) on my Debian server: netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n How do I ...
2
votes
1answer
743 views

Netstat shows two sshd's listening, but only one pid

On my Linode sudo netstat -tulp gives me: Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 *:ssh *:* LISTEN 2030/sshd ...
2
votes
1answer
201 views

Netstat hangs: why?

Sometimes (not too often at all) when I type "netstat", it takes over 5 seconds to return. While other times is instantaneous. I have been observing this for weeks on my server (CentOS 6.4), but I ...
2
votes
2answers
244 views

When using netstat on a listening port what is the difference between localhost:6666 and [::]:6666 in 'Local Address' field

Using ubuntu 11.04, I run netstat -nplt the results for local address may be localhost:6666 or [::]:6666 What is the difference? I believe that the [::]: binds the service at ...
2
votes
2answers
4k views

analyse TCP performance by interpreting “netstat -s”

I have executed netstat -s on my dedicated server running debian. I'd like to interprete the results because I'm experiencing connectivity problems with TCP. I don't know how to read these results. ...
2
votes
1answer
197 views

Cannot Connect Via RDP

I cannot connect via RDP to a win2003 server. Terminal services say that they're started, but a netstat shows nothing to do with port 3389. Any ideas?
2
votes
1answer
2k views

Too many established connections left open

I have a (probably quite old) CentOS 4.5 server with a custom java application running inside. I found the application was crashing after some running time and found it was handling 1024 connections ...
2
votes
2answers
2k views

(node) Hit max file limit. Increase “ulimit -n”

In Ubuntu 9 I am receiving a message on my server that says: (node) Hit max file limit. Increase "ulimit -n" However, typing commands in the terminal reveals the following: $ ulimit ...
2
votes
2answers
906 views

Apache many httpd process by my own server IP? eating all my Ram

Well i just bought a new dedicated server, I have no Linux experience, but i'm trying to learn. I have been testing the server for a few days. I improve the httpd.conf my.cnf for better performance, ...
2
votes
1answer
537 views

Why netstat reporting incorrect machine names?

I need to investigate what clients connected to my application and I am using the netstat command for this. I noticed that sometimes it does not report me the correct machine name. Why this is ...
2
votes
1answer
132 views

Find number of TCP bytes transmitted

I have rhel4 and rhel6 hosts. I can use netstat -s to see information on the number of segments sent/received. I can use ifconfig to see the number of bytes sent/received on a given interface (for ...
2
votes
1answer
124 views

Cannot install net-tools on Red Hat Linux

The isolated networking lab is running Red Hat Linux 9 (Shrike). We still use this "ancient" release, because given the simplicity of the protocols examined, it is sufficient. In addition, because of ...
2
votes
2answers
165 views

Determine from where is “sh” being run under apache www-data user using using PF or NETSTAT [duplicate]

I am working with a compromised Ubuntu 8.04 Plesk 9.5.4 server. It seems that a script on the server is continuously doing reverse lookups to random IPs on the Internet. I first spotted it during by ...
2
votes
1answer
669 views

iftop Shows Lots of Mysterious Connections - Not Showing in netstat

I've just stopped all pretty much all services except sshd on my server (Ubuntu Server 10.04), and when I run iftop I get output that looks like this: 12.5Kb 25.0Kb ...
2
votes
3answers
611 views

netstat issue: cannot pipe output from 'netstat -c' to an nfs mount

Short version: Netstat works fine except when I redirect output to a file in NFS. doesn't work: netstat -c > /nfs/mount/file works: netstat > /nfs/mount/file works: netstat -c works: ...
2
votes
1answer
4k views

TIME_WAIT in netstat of Apache processes

What are the meaning of the TIME_WAIT when using netstat of my web server process? I am sure the web server is not over loaded. tcp 0 0 0.0.0.0:80 0.0.0.0:* ...
2
votes
4answers
1k views

How to avoid external Javascript problem hanging server?

I've been having a strange problem with externally linked Javascript libraries hanging my load balancer server running HAProxy. I recently integrated the Quantcast monitoring script, and it worked ...
2
votes
1answer
899 views

What exactly does tcpOutAckDelayed mean, and is it a problem if it's counting up?

What does tcpOutAckDelayed mean, and what causes it to count up? is it an indication of problems or not? The sun doco isnt clear! Thanks, Dan