Skip to main content

Questions tagged [netstat]

netstat is a tool for viewing active network connections, listeners and sockets.

Filter by
Sorted by
Tagged with
0 votes
1 answer
34 views

linux + how to close connection that are not in used

from netstat -anp | grep :8088 | grep EST we can see the following connection ( is example from our hadoop server ) tcp 0 0 192.83.23.112:42360 192.83.66.114:8088 ESTABLISHED ...
King David's user avatar
0 votes
1 answer
181 views

RHEL + how to know the limit of concurrent connections number per port?

how to know the number of concurrent connections per port on RHEL 7.x machines for instance, let say we connect to port 9080 with XXXX concurrent connections. wget http://server_mngmnt.jupiter.com:...
King David's user avatar
-1 votes
1 answer
140 views

Why "netstat" doesn't show the ip of a server I'm connected to?

I have an audio stream from a Youtube video obtained by youtube-dl -g <URL> (this command outputs two links, for video and audio respectively). They have this form; https://rr1---sn-uqx2-w50l....
user2495207's user avatar
1 vote
0 answers
161 views

What does it mean when netstat outputs a dash in pid / program name column?

Here is some lightly modified output from netstat (I removed the addresses and names) a@xxxxx:/app# netstat -p Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address ...
zelinka's user avatar
  • 111
-1 votes
1 answer
78 views

How to get the command of a process by an established port while ss, netstat and lsof failed?

Recently I have noticed extremely high network usage on a ubuntu server. I identified the port with nethogs. It connects to a SMB server within my LAN. It should be connected at boot for the dozens of ...
crackpot's user avatar
  • 101
2 votes
1 answer
765 views

Blocking traffic from specific countries. How to kill existing connection?

Using Linux Debian Bookworm. Problem I want to block all incoming connections to my server coming from specific countries. Edit As someone pointed out in the comments, I really shouldn't be doing this ...
Zippy1970's user avatar
  • 289
0 votes
0 answers
85 views

Difference Send-Q between netstat and ss

The ss send-Q column shows non-zero value constantly, while netstat shows Send-Q as zero for same port and same process. Can you please let me know why like this and what does mean by non-zero value. ...
Rama's user avatar
  • 87
0 votes
0 answers
113 views

Martian packet with ARP broadcast traffic

Server nodes keep getting ARP broadcast traffic and becoming martian packets due to assymatric routing. I was known that when strict filtering is enabled with net.ipv4.conf.eth0.rp_filter = 1, the ...
Rama's user avatar
  • 87
0 votes
0 answers
92 views

PHP Error waiting on socket

I'm getting problems with ssh2 and fread php function that started on a few days. On the apache error log show: ssh2_connect(): Error starting up SSH connection(-9): Error waiting on socket fread(): ...
user1505698's user avatar
0 votes
2 answers
1k views

netstat no support on this system [closed]

in dealing with try to resolve another issue into my Ubuntu 22 OS I need to check out the ports that tightvnc is listening on for connections. I use this command : sudo netstat -lvp | grep vnc BUT ...
darkomen's user avatar
  • 103
1 vote
1 answer
363 views

What does "no ports" on netstat -s mean?

On Windows server 2016, when I execute, in a cmd prompt, "netstat -s" I get a bunch of statistics. One of those is "No Ports". What does this mean? Is this the number of times ...
Vincent's user avatar
  • 818
0 votes
0 answers
136 views

Can't create a pseudo network interface on Debian 11

I have a KVM based Debian 11 (bullseye) VPS with internet access on eth0 network adapter. The public IP has been assigned by DHCP. The IPs and Routes are as what follows: ifconfig and iptable BEFORE ...
Mohamad Reza's user avatar
-1 votes
1 answer
249 views

Take NetStat Dump After Every X Minutes

We have a lot of port exhaustion issues recently. I was reading https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/tcp-ip-port-exhaustion-troubleshooting?source=recommendations @...
Imran Qadir Baksh - Baloch's user avatar
0 votes
1 answer
521 views

NetStat Group By Process Id and Show Count

Is there any way to group the output given by netstat into process? I am running netstat -ano and doing manual count to know which process is using how many ports. I am using Windows Server. We have ...
Imran Qadir Baksh - Baloch's user avatar
0 votes
1 answer
133 views

What does `netstat -y` on Windows do?

From the help page of Windows netstat, I got this: -y Displays the TCP connection template for all connections. Cannot be combined with the other options. Google results are all same ...
n0obiscuitz's user avatar
0 votes
0 answers
257 views

how to continues netstat a port and save it to text file with time stamp for each netstat

I am using a system which is integrated to other system using a specific port and recently I am facing multiple interruption in the integration, and I need to monitor the port "48823" for a ...
Hossam M's user avatar
3 votes
0 answers
249 views

How to tell whether a linux tcp socket had recent activity?

Most of the time, when changing or upgrading a network service, I would do this during maintenance hours but some services are rarely used so it is tempting to just check whether it is currently in ...
Gamification's user avatar
0 votes
0 answers
604 views

Why NFS is listening to a port but not showing the process name, is there any security risk if no firewall is set?

I'm using ubuntu 22.04 and have mounted an NFS storage, here is my fstab file ftpback-bhs5-26.ip-149-56-30.net:/export/ftpbackup/ns524316.ip-xxx-xxx-xxx.net /media/backup nfs vers=4.0 0 0 When ...
maP1E bluE's user avatar
1 vote
0 answers
220 views

How to identify which os process is establishing a proxy connection

Platform: Red-Hat 7 I hope you can help me with this. I've been told that one proxy server we are using is going to be decommissioned in the following days. I've tried to use netstat in order to ...
Roberto Hernandez's user avatar
0 votes
1 answer
2k views

Nginx change default IP form 0.0.0.0 to pecific IP

I have nginx running as a web server. The virtual host have the IP specific configuration with IP addresses listed, however whtn I check netstat Nginx is litening on 0.0.0.0:80. I would like to change ...
Tibby's user avatar
  • 215
5 votes
2 answers
1k views

Early warning of port exhaustion in Linux

AFAIK, port exhaustion happens when a host is trying to establish a lot of connections to another server and the sessions used up all the available ephemeral ports. e.g. 192.168.1.1:port -> 10.20....
some user's user avatar
  • 181
0 votes
0 answers
333 views

How to block flooding "empty" connections from single IP

Right now netstat lists 200 - 4000 connections to the same IP in India. Seems like some kind of flooding attack to me. e.g: tcp 0 0 [removed] 182.65.238.[removed].in-:mysql TIME_WAIT I've ...
jan's user avatar
  • 1
3 votes
1 answer
3k views

Show TCP keepalive status in Windows?

Using netstat -to on a Linux system shows the status of tcp keepalive for a socket like this: Proto Recv-Q Send-Q Local Address Foreign Address State Timer tcp6 0 0 ...
T-Me's user avatar
  • 163
1 vote
2 answers
787 views

How to find a malicious TCP program using netstat [closed]

I am trying to do a homework for a lab but have a quick question. How do I find a malicious TCP service that is still running and the adversary has achieved persistence by creating a systemd service? ...
beveragerocks 's user avatar
2 votes
1 answer
309 views

Dovecot claims ports are in use, netstat disagrees

Attempting to start dovecot gives me this: Apr 28 13:37:00 master: Error: service(pop3-login): listen(*, 110) failed: Address already in use Apr 28 13:37:00 master: Error: service(pop3-login): listen(*...
user646372's user avatar
3 votes
2 answers
941 views

netstat reports UDP ports with no owning process

When I run netstat -avp udp I get a slowly growing number of ports. It grows about 100 an hour but the rate varies considerably. When I close the process, the ports do not disappear from the list. ...
Simon G.'s user avatar
  • 131
0 votes
1 answer
189 views

Exim established many connections to strange ips

I installed VestaCP and used their mail server for my domain mails. But when I run netstat on my server,it shows some strange connections. There are no problems with my mail server until now, I just ...
Huynh Vinh Phat's user avatar
3 votes
0 answers
1k views

Kernel TCP tuning for buffer overrun and packet collapse

We have a Nginx+Ruby application where the data between Nginx and the application are interfaced through a socket. As part of performance improvement, when we analyzed the netstat statistics on the ...
madu's user avatar
  • 153
0 votes
0 answers
105 views

Showing all http connections in vm instance

I have a Google Cloud VM instance running Debian and a dockerized Apache httpd inside. I'm trying to count all the http connections in the machine. I run this: for i in {1..1000}; do netstat -at | wc -...
Héctor's user avatar
  • 187
4 votes
1 answer
7k views

cURL can connect to localhost but browser cannot

My system is Win10 with WSL2, I ran a gogs docker container (from ubuntu in WSL): 83b2a8833235 gogs/gogs "/app/gogs/docker/st…" 17 minutes ago Up 17 minutes 0....
Ken Tsoi's user avatar
  • 143
0 votes
1 answer
207 views

New netstat Ubuntu 20.10

I have been using netstat 1.42 without any problem but yesterday I installed a fresh VPS and when I try to set commands netstat does not show anything. I use this command to see all active TCP ...
Roberto Nervo's user avatar
0 votes
1 answer
266 views

Want to enable Windows Server firewall - how to know what ports to open

For added security, we're thinking of enabling the firewalls on our 2016 and 2019 servers. Currently, they're all behind our edge router/firewall, and every server has its firewall disabled. Sometimes,...
00fruX's user avatar
  • 123
0 votes
1 answer
848 views

Ngnix Closes The Connection Doesn't Return 301

struggling to get my hosts to work on port 80/HTTP and redirect to HTTPS. Discovered this when I gave out a URL and they said it didn't work but noticed a direct link to the site did work. I've done ...
John Lamar's user avatar
0 votes
0 answers
150 views

Why two TCP connections to mysql server?

When I connect to a mysql server via a client, it seems to create two new TCP connections each time, for example doing: $ netstat -a |grep mysql # tcp4 0 0 lmy.att.64710 ec2-54-00.mysql ...
David542's user avatar
  • 979
0 votes
0 answers
539 views

OpenVPN Access Server has a lot of listening ports

I have setup OpenVPN Access Server for a small private cloud network. It works great, but I am wondering about all these 900 ports showing up in netstat from part of the system called openvpn-openss. ...
Jette's user avatar
  • 113
1 vote
0 answers
292 views

Get information about socket of unknown domain

The output of lsof (revision: 4.87) on centos 7.8.2003 shows: COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME java 30858 xxxx 841u sock 0,7 ...
William Pursell's user avatar
0 votes
0 answers
907 views

netstat shows a listening port with no pid and can't find pid with rpcinfo and ss and lsof

I tried bind nc on port 41120, but it said port has already been used. So I want to find out which process binded this port and if I can kill it. I executed netstat  -taupen| grep  41120 and it shows ...
fajin yu's user avatar
  • 215
0 votes
2 answers
462 views

Netstat port status

How can I see all ports and their status on my pc using netsat? (All 2^16 ports) And how can I list apps that have an open port in transport layer of my computer with application name and it's port? ...
m0ss's user avatar
  • 105
0 votes
1 answer
893 views

what are the options to close manual the port correctly or release the port on rhel machines?

we have redhat 7.5 server we are suspect that port 50070 not closed correctly by the service , ( we check by netstat and PID not found ) but from the log we can see that port is in use so we try to do ...
King David's user avatar
1 vote
1 answer
661 views

SAMBA netstat local address 0.0.0.0

Trying to run samba AD DC but I'm stuck. After created domain provision, I defined resolv.conf: cat /etc/resolv.conf nameserver 10.99.0.30 search example.com Service running: samba-ad-dc.service - ...
SimonLi's user avatar
  • 69
0 votes
1 answer
215 views

New and Unknown Netstat Entries

OS = Debian 10. When I run netstat -natp, I have two unidentified entries which are concerning. tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 24310/redis-server ...
branch.lizard's user avatar
0 votes
1 answer
217 views

Proxy service only responding on some IP addresses (others suck on SYN_RECV)

I have a server using a proxy service (WAF etc) which forwards packets to my server. I can see established SSL conenctions from all proxy netstat -an and the rest stuck in SYN_RECV: tcp 0 ...
morleyc's user avatar
  • 1,130
3 votes
1 answer
727 views

DDOS manual mitigation using command netstat. How to determine real attackers?

When my server is slow, I have been told to run this command and check if someone is making a request of SYN_RECV to slow down my server: netstat -npt | grep SYN_RECV | awk '{print $5}' | grep -Eo '(...
Kalib Zen's user avatar
  • 137
0 votes
1 answer
2k views

netstat how to exclude localhost from the result when using grep

When I run this command in my terminal: netstat -an | egrep ":80|:443" | sort I got this following output: tcp 0 0 172.104.10.125:48310 172.104.10.125:8081 TIME_WAIT tcp ...
Kalib Zen's user avatar
  • 137
1 vote
3 answers
4k views

How can a server accept incoming traffic to port 443 if it isn't listed in netstat?

I have a server that is currently accepting HTTPS requests and the only thing that shows with netstat -plnt is this: elijahlynn@web:~$ sudo netstat -plnt Active Internet connections (only servers) ...
Elijah Lynn's user avatar
4 votes
0 answers
2k views

Find the process listening on a port (not showing in lsof)

Update: The port was opened by NFS. I figured this out by configuring NFS to listen on a known port. Using Ubuntu 18.04 I want to know which process or kernel function listens on UDP port 38637. I ...
jchook's user avatar
  • 141
0 votes
1 answer
365 views

Linux service is listening and responding on ports it wasn't assigned and that don't show up in netstat

I have an Amazon Linux 1 instance that was created from a Solarwinds DPA AMI. I created this around 2 years ago. It is possible I did something weird back then to make this happen. Today, I upgraded ...
Appleoddity's user avatar
  • 3,872
0 votes
1 answer
214 views

Huge amount of imap-login netstat

When I run a netstat -plantu I have a huge amount of ESTABLISHED imap-login, perhaps 50 or 60 connection. Some connections have in column Send-Q a big number like 3211206 or 114636 for example, and ...
simon's user avatar
  • 149
11 votes
3 answers
8k views

How to catch DNS request using 'netstat' in Unix

I am working in a bank where 'netcat' is not there. I am having problem wherein one DNS server of the two going down is causing impact. In order to troubleshoot, I need to catch the request (incoming ...
Biman Roy's user avatar
  • 177
0 votes
0 answers
215 views

List active sessions from tun interface

I'm running CentOS and have a tun interface with IP subnet 10.0.0.0/24 attached for "users". Is it possible to list current active sessions with netstat, ss or similar? Ex. netstat something: tun-...
Alfred Balle's user avatar

1
2 3 4 5
7