Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [netstat]

netstat is a tool for viewing active network connections, listeners and sockets.

-1
votes
0answers
8 views

Open port not listed in netstat command results [duplicate]

before asking thank you in advance to whoever answers and advise! I'm trying to open port 13000 using the following CMD command: Netsh advfirewall firewall add rule name="defender port" dir=in ...
0
votes
0answers
30 views

Netstat showing python services listening to multiple ports

In my search to reduce the vulnerabilities of a server, I used netstat to check which ports are listening and stumbled upon a cascade of python services listening to a large number of ports, as shown: ...
0
votes
1answer
27 views

Remove tcp entry from netstat -a

I have a rather strange issue and no matter what I do or search, I cannot rectify it and have now decided to seek help here initially. I have a cluster of servers, about 10 clustered together. A few ...
0
votes
0answers
44 views

Why can't I ping 127.0.0.1 from some network interfaces?

I'm on OS Sierra. This is (part of) what I get on ifconfig ... en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500 ether 98:01:a7:b4:91:63 inet6 fe80::4e:52ae:9fa8:...
1
vote
1answer
31 views

netstat vs nmap to find IPs in a local network

I'm in a local network : IPv4 shared address space (100.x.x.x). Connected to a wifi hotspot. Ip ranges : 100.76.164.0/23 When I run : nmap 100.76.164.0/23 : It says all the hosts are down netstat -...
2
votes
1answer
44 views

netstat says connection in SYN_SENT but tcpdump captures no data

I'm debugging a ldap problem after ldap client machine upgraded to ubuntu 18.04. Trying to figure out where the problem is, and I noticed the outbound connection is in SYN_SENT, but when I use tcpdump ...
0
votes
0answers
40 views

Remote Client is unable to connect to TCP Server on VPS (Getting 10060 error)

I have searched all over the internet for the solution. Unfortunately, I could not get any working solution yet. Here is the story. I am running TCP server for small communication application on the ...
0
votes
0answers
4 views

trc-netpoll service on tcpdump

I was doing a tcpdump on my wifi adapter. I found a lot of trc-netpoll continuously flowing through it (more than 10 per millisecond) I just have ssh enabled on server and accessing it via a putty ...
1
vote
1answer
144 views

netstat shows connected socket with path to it, but path doesn't exist

Im inside a docker container and ran netstat -x | grep docker which got me the: unix 3 [ ] STREAM CONNECTED 62288711 /var/run/docker.sock unix 3 [ ] STREAM ...
-1
votes
2answers
51 views

how to get file download connections on linux

I have a site with video content (mp4 files). When people are watching videos, they are downloading video files from my site. I want to know the number of the active connections via the linux ...
0
votes
1answer
116 views

On a web server, is it normal to see a thousand connections coming from one user?

When I saw so many connections from one IP (by using netstat), I thought it's bot. (The website is not popular so it's very unlikely to be multiple users behind one IP.) But I checked apache access ...
0
votes
0answers
68 views

Collectd won't open listener

So I've been stuck with this for sometime now. I want to use collectd with graphite. Im using centos 7. I've made the necessary changes in collectd.conf as seen below: [root@relay-1 ~]# grep -v "#" /...
2
votes
1answer
74 views

why are there are so many svchost established connections to Isilon?

Our client has a Isilon (used only for smb) with few nodes attached to it. When I run TCPView I don't understand why svchost service established the connection and why there're so many of them: And ...
0
votes
0answers
14 views

Tracking down malware network activity [duplicate]

OS: Debian 8 I have over 30 websites running on my webserver. Since yesterday there has been some suspicious outgoing internet activity related to the address "192.42.116.41". After a quick google ...
0
votes
1answer
124 views

Uderstanding netstat output

When I run netstat -b on Windows 10 I get lots of results of similar nature TCP 127.0.0.1:64248 LocalHostName:64249 ESTABLISHED [w3wp.exe] TCP 127.0.0.1:64249 LocalHostName:...
0
votes
0answers
35 views

Network application on Docker

I have an application that when running straight on the host machine is appointed by netstat no have over 45k ESTABLISHED connections. I am now giving a try on Docker, however I see some difficulty ...
0
votes
1answer
67 views

Why is kjournald showing up 700 times in `netstat`?

AFAIK, kjournald is not a network program, but a program that deals with the journal of EXT3 (I am running EXT4 on Ubuntu 16.04). Still, when running sudo netstap -tapn it shows up almost 700 times, ...
0
votes
0answers
43 views

Difference between /proc/user_beancounters numtcpsock and netstat -an?

Can you help me to understand the difference between the numtcpsock held value (actual value: 33) cat /proc/user_beancounters | grep numtcpsock And the value I geht with (actual value: 463) netstat ...
1
vote
0answers
175 views

How to configure Linux to close the connection if Send-Q is never sent?

There is a TCP client-server connection. The application on the server is sending data regularly. Client machine is then reset physically. Netstat shows Send-Q on the server is filling up, the ...
0
votes
1answer
90 views

weird netstat output on netscaler

We have a VPX-1000 netscaler. When traffic suddenly increases our website goes offline and doesn't response to requests but our netscaler load is fine (cpu %40 ram %50 4 cores 4gb). After incident ...
1
vote
1answer
1k views

Debian 8 - getnameinfo Failed Error - netstat

I am experiencing a error/warning when running any netstat command on my Debian 8 machine. One of the commands:- netstat | grep http | wc -l The result:- getnameinfo failed getnameinfo ...
0
votes
1answer
546 views

What are all these DGRAM items in NETSTAT?

I am assigned a server that has been sending tons of data ourside and isn't used. So, it is most likely compromised. Nothing really seems to be out of order on the server except, they're miles and ...
0
votes
1answer
786 views

Docker networking IPv6 exposed

I'm running a small arm board providing some services within our local network. As I try to understand the ipv6 support of docker, I am quite confused about the results of my first tests. My network ...
0
votes
1answer
240 views

“0/2” IPv4 destination in “netstat -nr” command on Mac OS X to view host routing table

I'm using the command "netstat -nr" to view the host routing table on a Mac OS X system, and here's the output I'm getting: Routing tables Internet: Destination Gateway Flags ...
-1
votes
1answer
36 views

syslog for netstat to get no. of connection from each IP range

I have a server which keeps on receiving request from two other servers from different IP ranges. I need to know how can I setup a cronjob which keeps on checking number of connection made by each ...
0
votes
0answers
44 views

Track down application/process causing computer broacasting destination 255.255.255.255 port 0

We have installed Untangle and we see many broadcasts from 1 IP (client Windows 7). Almost every minute it is broadcasting to 255.255.255.255 port 0. I would like to know how to trace the source of ...
0
votes
1answer
66 views

I cannot ping to destination IP even after adding a ip tunnel

So I have a virtual device with ip 192.168.16.15/24(device X). I'm trying to ping this from another device 10.64.95.120/24(device A). This virtual device(device X) is created on another server 10.64....
0
votes
2answers
343 views

openVPN and myhttpd on port 433

I'm trying to set up OpenVPN to listen on port 443 on my Asustor NAS, and then pass all HTTPS traffic to Apache, by using the port-share option based on: OpenVPN port-share with Apache/SSL However i'...
0
votes
3answers
514 views

Man in The Middle Attack, or something else?

I was wondering if someone could help me out with this problem. We have a webservice that is available only through https:// port 443. Using netstat I see that there is particular ip that tries to ...
2
votes
0answers
257 views

Windows netstat vs WMIC bytes sent/received difference

I'm trying to understand the difference between the bytes sent/received values returned by both netstat and wmic on Windows. I'm having a hard time finding an explanation for the significant variation....
0
votes
1answer
337 views

UDP connections with no foreign address

Ubuntu 14.04 $ netstat -anu | less Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State udp 0 0 0.0.0.0:...
-1
votes
1answer
115 views

Check Used Ports on Linux without Command [closed]

Is there a way to check Used Ports on Linux without commands, I mean checking files or so on ?
0
votes
0answers
508 views

Digital Ocean - Outgoing DOS attack

noob here. My droplet has experienced an outgoing DOS attack, as informed by Digital Ocean and networking has been disabled. This has happened twice in the last two days. Previous droplet also was ...
2
votes
1answer
390 views

Opening A Port In Redhat Enterprise Linux Fails

I have a veritas backup server (windows server 2012) that I use for backup. One of the server I need to backup (Redhat Enterprise Linux 5.9) is failing to communicate with my backup server. I have ...
1
vote
1answer
608 views

How to deal with TCP connections attack on Linux

My server is being flooded until apache becomes non-responsive, and I need some help finding and blocking the responsible IP address(es). Normally, I don't have more than 150 connections. Now I have ...
0
votes
1answer
2k views

Too many TIME_WAIT connections on mysql from an outside host

My netstat is showing over 2,000 mysql connections with the state of TIME_WAIT that seems to be stuck and won't go away. It's been like that for several hours and many of the connections are coming ...
1
vote
0answers
685 views

In the output of netstat -r, what is the meaning of the “Netif” column and how does it differ to the “Gateway” column?

I can find virtually no documentation of the meaning of the column "Netif" in the output of netstat -rn. Googled for it, searched through the netstat(1) and route(8) man pages and found the following ...
1
vote
1answer
80 views

How can destination addresses 132.148.77.28 and 132.148.77.28/32 be use different network interfaces for routing?

The output of netstat -rn on my FreeBSD virtual machine shows that: Internet: Destination Gateway Flags Netif Expire default 10.195.51.254 UGS vtnet0 10....
0
votes
1answer
100 views

What application is connecting to a remote site?

I can see with Wireshark that every 5 minutes I have a connection from my computer to ip 165.254.162.243 on udp/8253. This has been going for months. I cannot identify what application or process is ...
4
votes
2answers
777 views

Heavy TCP traffic on loopback

While trying to generate some test traffic on my loopback interface, I noticed there was so much noise there that the output from Wireshark was essentially useless, with tons of SYN/RST, ACK packets ...
0
votes
2answers
88 views

No webserver running, but replying to packets on ports 80 and 443

I see from iptables that my Centos 7 machine is receiving and sending out packets on ports 80 and 443. I don't have a webserver running, and netstat returned nothing for those ports. Is this normal?
0
votes
0answers
73 views

Why alot of netstat poiting to external url

Our server was almost like being DDOS. When doing netstat -a , I saw something that I cannot understand (maybe due to my very limited knowledge) root@NC-PH-0456-19:~# netstat -a Active ...
0
votes
1answer
2k views

Server 2012 R2 ephemeral ports all slowly being bound

One of our remote desktop session host servers has started to refuse connection every few days, and upon investigation, it seems it is exhausting available ephemeral ports. This was identified by ...
2
votes
1answer
196 views

What is running on port 49181 Windows 7

I have an application that relies on port 63000 for communicating with other devices over the network. Some while ago this app stopped working on the PC. I tried all sorts of firewall configs, ON/...
0
votes
1answer
606 views

Linux 'ss' command - TCP connections

I am getting below output/summary while running few gatling & AB perf test as a result of command - $ ss -stplu Output - Total: 517 (kernel 0) TCP: 11261 (estab 3, closed 11254, orphaned 1, ...
0
votes
1answer
1k views

Getting current connections from nginx/access.log

Hello im looking for command like this netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n But based on activity from /var/log/nginx/access.log Im aware that access.log can't ...
2
votes
2answers
60 views

Source and destination servers showing different number of established TCP connections

I have a JBoss app server and a Postgres database server on different machines. I'm troubleshooting TCP connections between them (because the app keeps running out of database connections). I'm ...
0
votes
1answer
348 views

Route Add not taking effect Windows Server 2012

I'm trying to route traffic to a specific subnet through a specific device. I've added the route successfully, yet any time I run a trace route to an IP on that subnet, it is not routing through the ...
2
votes
0answers
1k views

Can't bind UDP socket but port is free

I've been struggling for a while now with this so maybe someone here is able to help me. I'm setting up a CS:GO server that's going to be running on port 27059. (This is a copy&paste from a ...
1
vote
0answers
263 views

Why netstat -p doesn't show PID of established connections?

I have some REST service which is listening on tcp/8051 I'm querying this service with curl in infinite loop from the same host: while true; do curl --header "Authorization: Bearer ...