Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [netstat]

netstat is a tool for viewing active network connections, listeners and sockets.

0
votes
0answers
22 views

CENTOS 7 - Auto block IP with null routes

Whenever I notice overload on my media (videos) server, I check for ddos with this command from netstat: netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n It shows currently ...
0
votes
1answer
39 views

Remove tcp entry from netstat -a

I have a rather strange issue and no matter what I do or search, I cannot rectify it and have now decided to seek help here initially. I have a cluster of servers, about 10 clustered together. A few ...
0
votes
0answers
46 views

Why can't I ping 127.0.0.1 from some network interfaces?

I'm on OS Sierra. This is (part of) what I get on ifconfig ... en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500 ether 98:01:a7:b4:91:63 inet6 fe80::4e:52ae:9fa8:...
1
vote
1answer
52 views

netstat vs nmap to find IPs in a local network

I'm in a local network : IPv4 shared address space (100.x.x.x). Connected to a wifi hotspot. Ip ranges : 100.76.164.0/23 When I run : nmap 100.76.164.0/23 : It says all the hosts are down netstat -...
2
votes
1answer
123 views

netstat says connection in SYN_SENT but tcpdump captures no data

I'm debugging a ldap problem after ldap client machine upgraded to ubuntu 18.04. Trying to figure out where the problem is, and I noticed the outbound connection is in SYN_SENT, but when I use tcpdump ...
0
votes
0answers
79 views

Remote Client is unable to connect to TCP Server on VPS (Getting 10060 error)

I have searched all over the internet for the solution. Unfortunately, I could not get any working solution yet. Here is the story. I am running TCP server for small communication application on the ...
1
vote
1answer
219 views

netstat shows connected socket with path to it, but path doesn't exist

Im inside a docker container and ran netstat -x | grep docker which got me the: unix 3 [ ] STREAM CONNECTED 62288711 /var/run/docker.sock unix 3 [ ] STREAM ...
-1
votes
2answers
53 views

how to get file download connections on linux

I have a site with video content (mp4 files). When people are watching videos, they are downloading video files from my site. I want to know the number of the active connections via the linux ...
0
votes
1answer
118 views

On a web server, is it normal to see a thousand connections coming from one user?

When I saw so many connections from one IP (by using netstat), I thought it's bot. (The website is not popular so it's very unlikely to be multiple users behind one IP.) But I checked apache access ...
0
votes
0answers
80 views

Collectd won't open listener

So I've been stuck with this for sometime now. I want to use collectd with graphite. Im using centos 7. I've made the necessary changes in collectd.conf as seen below: [root@relay-1 ~]# grep -v "#" /...
2
votes
1answer
81 views

why are there are so many svchost established connections to Isilon?

Our client has a Isilon (used only for smb) with few nodes attached to it. When I run TCPView I don't understand why svchost service established the connection and why there're so many of them: And ...
0
votes
0answers
14 views

Tracking down malware network activity [duplicate]

OS: Debian 8 I have over 30 websites running on my webserver. Since yesterday there has been some suspicious outgoing internet activity related to the address "192.42.116.41". After a quick google ...
0
votes
1answer
167 views

Uderstanding netstat output

When I run netstat -b on Windows 10 I get lots of results of similar nature TCP 127.0.0.1:64248 LocalHostName:64249 ESTABLISHED [w3wp.exe] TCP 127.0.0.1:64249 LocalHostName:...
0
votes
0answers
35 views

Network application on Docker

I have an application that when running straight on the host machine is appointed by netstat no have over 45k ESTABLISHED connections. I am now giving a try on Docker, however I see some difficulty ...
0
votes
1answer
70 views

Why is kjournald showing up 700 times in `netstat`?

AFAIK, kjournald is not a network program, but a program that deals with the journal of EXT3 (I am running EXT4 on Ubuntu 16.04). Still, when running sudo netstap -tapn it shows up almost 700 times, ...
1
vote
0answers
188 views

How to configure Linux to close the connection if Send-Q is never sent?

There is a TCP client-server connection. The application on the server is sending data regularly. Client machine is then reset physically. Netstat shows Send-Q on the server is filling up, the ...
0
votes
1answer
99 views

weird netstat output on netscaler

We have a VPX-1000 netscaler. When traffic suddenly increases our website goes offline and doesn't response to requests but our netscaler load is fine (cpu %40 ram %50 4 cores 4gb). After incident ...
1
vote
1answer
2k views

Debian 8 - getnameinfo Failed Error - netstat

I am experiencing a error/warning when running any netstat command on my Debian 8 machine. One of the commands:- netstat | grep http | wc -l The result:- getnameinfo failed getnameinfo ...
0
votes
1answer
689 views

What are all these DGRAM items in NETSTAT?

I am assigned a server that has been sending tons of data ourside and isn't used. So, it is most likely compromised. Nothing really seems to be out of order on the server except, they're miles and ...
0
votes
1answer
1k views

Docker networking IPv6 exposed

I'm running a small arm board providing some services within our local network. As I try to understand the ipv6 support of docker, I am quite confused about the results of my first tests. My network ...
0
votes
1answer
264 views

“0/2” IPv4 destination in “netstat -nr” command on Mac OS X to view host routing table

I'm using the command "netstat -nr" to view the host routing table on a Mac OS X system, and here's the output I'm getting: Routing tables Internet: Destination Gateway Flags ...
-1
votes
1answer
40 views

syslog for netstat to get no. of connection from each IP range

I have a server which keeps on receiving request from two other servers from different IP ranges. I need to know how can I setup a cronjob which keeps on checking number of connection made by each ...
0
votes
0answers
60 views

Track down application/process causing computer broacasting destination 255.255.255.255 port 0

We have installed Untangle and we see many broadcasts from 1 IP (client Windows 7). Almost every minute it is broadcasting to 255.255.255.255 port 0. I would like to know how to trace the source of ...
0
votes
1answer
73 views

I cannot ping to destination IP even after adding a ip tunnel

So I have a virtual device with ip 192.168.16.15/24(device X). I'm trying to ping this from another device 10.64.95.120/24(device A). This virtual device(device X) is created on another server 10.64....
0
votes
2answers
387 views

openVPN and myhttpd on port 433

I'm trying to set up OpenVPN to listen on port 443 on my Asustor NAS, and then pass all HTTPS traffic to Apache, by using the port-share option based on: OpenVPN port-share with Apache/SSL However i'...
0
votes
3answers
600 views

Man in The Middle Attack, or something else?

I was wondering if someone could help me out with this problem. We have a webservice that is available only through https:// port 443. Using netstat I see that there is particular ip that tries to ...
2
votes
0answers
305 views

Windows netstat vs WMIC bytes sent/received difference

I'm trying to understand the difference between the bytes sent/received values returned by both netstat and wmic on Windows. I'm having a hard time finding an explanation for the significant variation....
0
votes
1answer
361 views

UDP connections with no foreign address

Ubuntu 14.04 $ netstat -anu | less Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State udp 0 0 0.0.0.0:...
-1
votes
1answer
137 views

Check Used Ports on Linux without Command [closed]

Is there a way to check Used Ports on Linux without commands, I mean checking files or so on ?
0
votes
0answers
574 views

Digital Ocean - Outgoing DOS attack

noob here. My droplet has experienced an outgoing DOS attack, as informed by Digital Ocean and networking has been disabled. This has happened twice in the last two days. Previous droplet also was ...
2
votes
1answer
426 views

Opening A Port In Redhat Enterprise Linux Fails

I have a veritas backup server (windows server 2012) that I use for backup. One of the server I need to backup (Redhat Enterprise Linux 5.9) is failing to communicate with my backup server. I have ...
1
vote
1answer
670 views

How to deal with TCP connections attack on Linux

My server is being flooded until apache becomes non-responsive, and I need some help finding and blocking the responsible IP address(es). Normally, I don't have more than 150 connections. Now I have ...
0
votes
1answer
2k views

Too many TIME_WAIT connections on mysql from an outside host

My netstat is showing over 2,000 mysql connections with the state of TIME_WAIT that seems to be stuck and won't go away. It's been like that for several hours and many of the connections are coming ...
1
vote
0answers
750 views

In the output of netstat -r, what is the meaning of the “Netif” column and how does it differ to the “Gateway” column?

I can find virtually no documentation of the meaning of the column "Netif" in the output of netstat -rn. Googled for it, searched through the netstat(1) and route(8) man pages and found the following ...
1
vote
1answer
82 views

How can destination addresses 132.148.77.28 and 132.148.77.28/32 be use different network interfaces for routing?

The output of netstat -rn on my FreeBSD virtual machine shows that: Internet: Destination Gateway Flags Netif Expire default 10.195.51.254 UGS vtnet0 10....
0
votes
1answer
108 views

What application is connecting to a remote site?

I can see with Wireshark that every 5 minutes I have a connection from my computer to ip 165.254.162.243 on udp/8253. This has been going for months. I cannot identify what application or process is ...
4
votes
2answers
889 views

Heavy TCP traffic on loopback

While trying to generate some test traffic on my loopback interface, I noticed there was so much noise there that the output from Wireshark was essentially useless, with tons of SYN/RST, ACK packets ...
0
votes
2answers
89 views

No webserver running, but replying to packets on ports 80 and 443

I see from iptables that my Centos 7 machine is receiving and sending out packets on ports 80 and 443. I don't have a webserver running, and netstat returned nothing for those ports. Is this normal?
0
votes
0answers
75 views

Why alot of netstat poiting to external url

Our server was almost like being DDOS. When doing netstat -a , I saw something that I cannot understand (maybe due to my very limited knowledge) root@NC-PH-0456-19:~# netstat -a Active ...
0
votes
1answer
2k views

Server 2012 R2 ephemeral ports all slowly being bound

One of our remote desktop session host servers has started to refuse connection every few days, and upon investigation, it seems it is exhausting available ephemeral ports. This was identified by ...
2
votes
1answer
210 views

What is running on port 49181 Windows 7

I have an application that relies on port 63000 for communicating with other devices over the network. Some while ago this app stopped working on the PC. I tried all sorts of firewall configs, ON/...
0
votes
1answer
687 views

Linux 'ss' command - TCP connections

I am getting below output/summary while running few gatling & AB perf test as a result of command - $ ss -stplu Output - Total: 517 (kernel 0) TCP: 11261 (estab 3, closed 11254, orphaned 1, ...
0
votes
1answer
2k views

Getting current connections from nginx/access.log

Hello im looking for command like this netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n But based on activity from /var/log/nginx/access.log Im aware that access.log can't ...
2
votes
2answers
61 views

Source and destination servers showing different number of established TCP connections

I have a JBoss app server and a Postgres database server on different machines. I'm troubleshooting TCP connections between them (because the app keeps running out of database connections). I'm ...
0
votes
1answer
397 views

Route Add not taking effect Windows Server 2012

I'm trying to route traffic to a specific subnet through a specific device. I've added the route successfully, yet any time I run a trace route to an IP on that subnet, it is not routing through the ...
2
votes
0answers
1k views

Can't bind UDP socket but port is free

I've been struggling for a while now with this so maybe someone here is able to help me. I'm setting up a CS:GO server that's going to be running on port 27059. (This is a copy&paste from a ...
1
vote
0answers
277 views

Why netstat -p doesn't show PID of established connections?

I have some REST service which is listening on tcp/8051 I'm querying this service with curl in infinite loop from the same host: while true; do curl --header "Authorization: Bearer ...
0
votes
1answer
153 views

Irresponsive nginx while doing “nginx reload”

While reloading nginx, I started getting errors in messages log "possible SYN flooding on port 443", and it seems like nginx becomes completely irresponsive at that time (quite for a while), cause ...
1
vote
0answers
31 views

netstats shows my own server is hitting a server its not supposed to know about

On AWS I have a few dedicated servers that do image processing, and they seem to get high traffic and fail. When running netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n I ...
0
votes
1answer
2k views

Check number of connections to webserver port 80 AND 443

As the title says how would one check the number of open connections to a webserver on port 80 and 443? I'm currently using this oneliner to get the number of open connections per ipaddress from port ...