Questions tagged [netstat]
netstat is a tool for viewing active network connections, listeners and sockets.
0
votes
1answer
14 views
netstat says connection in SYN_SENT but tcpdump captures no data
I'm debugging a ldap problem after ldap client machine upgraded to ubuntu 18.04. Trying to figure out where the problem is, and I noticed the outbound connection is in SYN_SENT, but when I use tcpdump ...
0
votes
0answers
25 views
Remote Client is unable to connect to TCP Server on VPS (Getting 10060 error)
I have searched all over the internet for the solution. Unfortunately, I could not get any working solution yet. Here is the story.
I am running TCP server for small communication application on the ...
0
votes
0answers
4 views
trc-netpoll service on tcpdump
I was doing a tcpdump on my wifi adapter. I found a lot of trc-netpoll continuously flowing through it (more than 10 per millisecond)
I just have ssh enabled on server and accessing it via a putty ...
1
vote
0answers
95 views
netstat shows connected socket with path to it, but path doesn't exist
Im inside a docker container and ran netstat -x | grep docker
which got me the:
unix 3 [ ] STREAM CONNECTED 62288711 /var/run/docker.sock
unix 3 [ ] STREAM ...
-1
votes
2answers
51 views
how to get file download connections on linux
I have a site with video content (mp4 files).
When people are watching videos, they are downloading video files from my site. I want to know the number of the active connections via the linux ...
0
votes
1answer
116 views
On a web server, is it normal to see a thousand connections coming from one user?
When I saw so many connections from one IP (by using netstat), I thought it's bot.
(The website is not popular so it's very unlikely to be multiple users behind one IP.)
But I checked apache access ...
0
votes
0answers
53 views
Collectd won't open listener
So I've been stuck with this for sometime now. I want to use collectd with graphite. Im using centos 7. I've made the necessary changes in collectd.conf as seen below:
[root@relay-1 ~]# grep -v "#" /...
1
vote
1answer
66 views
why are there are so many svchost established connections to Isilon?
Our client has a Isilon (used only for smb) with few nodes attached to it. When I run TCPView I don't understand why svchost service established the connection and why there're so many of them:
And ...
0
votes
0answers
14 views
Tracking down malware network activity [duplicate]
OS: Debian 8
I have over 30 websites running on my webserver. Since yesterday there has been some suspicious outgoing internet activity related to the address "192.42.116.41".
After a quick google ...
0
votes
1answer
58 views
Uderstanding netstat output
When I run netstat -b on Windows 10
I get lots of results of similar nature
TCP 127.0.0.1:64248 LocalHostName:64249 ESTABLISHED
[w3wp.exe]
TCP 127.0.0.1:64249 LocalHostName:...
0
votes
0answers
35 views
Network application on Docker
I have an application that when running straight on the host machine is appointed by netstat no have over 45k ESTABLISHED connections.
I am now giving a try on Docker, however I see some difficulty ...
0
votes
1answer
63 views
Why is kjournald showing up 700 times in `netstat`?
AFAIK, kjournald is not a network program, but a program that deals with the journal of EXT3 (I am running EXT4 on Ubuntu 16.04). Still, when running sudo netstap -tapn it shows up almost 700 times, ...
0
votes
0answers
39 views
Difference between /proc/user_beancounters numtcpsock and netstat -an?
Can you help me to understand the difference between the numtcpsock held value (actual value: 33)
cat /proc/user_beancounters | grep numtcpsock
And the value I geht with (actual value: 463)
netstat ...
1
vote
0answers
161 views
How to configure Linux to close the connection if Send-Q is never sent?
There is a TCP client-server connection. The application on the server is sending data regularly. Client machine is then reset physically. Netstat shows Send-Q on the server is filling up, the ...
0
votes
1answer
82 views
weird netstat output on netscaler
We have a VPX-1000 netscaler. When traffic suddenly increases our website goes offline and doesn't response to requests but our netscaler load is fine (cpu %40 ram %50 4 cores 4gb). After incident ...
1
vote
1answer
1k views
Debian 8 - getnameinfo Failed Error - netstat
I am experiencing a error/warning when running any netstat command on my Debian 8 machine.
One of the commands:-
netstat | grep http | wc -l
The result:-
getnameinfo failed
getnameinfo ...
0
votes
1answer
435 views
What are all these DGRAM items in NETSTAT?
I am assigned a server that has been sending tons of data ourside and isn't used. So, it is most likely compromised. Nothing really seems to be out of order on the server except, they're miles and ...
0
votes
1answer
653 views
Docker networking IPv6 exposed
I'm running a small arm board providing some services within our local network. As I try to understand the ipv6 support of docker, I am quite confused about the results of my first tests.
My network ...
0
votes
1answer
210 views
“0/2” IPv4 destination in “netstat -nr” command on Mac OS X to view host routing table
I'm using the command "netstat -nr" to view the host routing table on a Mac OS X system, and here's the output I'm getting:
Routing tables
Internet:
Destination Gateway Flags ...
-1
votes
1answer
31 views
syslog for netstat to get no. of connection from each IP range
I have a server which keeps on receiving request from two other servers from different IP ranges. I need to know how can I setup a cronjob which keeps on checking number of connection made by each ...
0
votes
0answers
42 views
Track down application/process causing computer broacasting destination 255.255.255.255 port 0
We have installed Untangle and we see many broadcasts from 1 IP (client Windows 7). Almost every minute it is broadcasting to 255.255.255.255 port 0.
I would like to know how to trace the source of ...
0
votes
1answer
60 views
I cannot ping to destination IP even after adding a ip tunnel
So I have a virtual device with ip 192.168.16.15/24(device X). I'm trying to ping this from another device 10.64.95.120/24(device A). This virtual device(device X) is created on another server 10.64....
0
votes
1answer
273 views
openVPN and myhttpd on port 433
I'm trying to set up OpenVPN to listen on port 443 on my Asustor NAS, and then pass all HTTPS traffic to Apache, by using the port-share option based on:
OpenVPN port-share with Apache/SSL
However i'...
0
votes
3answers
428 views
Man in The Middle Attack, or something else?
I was wondering if someone could help me out with this problem.
We have a webservice that is available only through https:// port 443.
Using netstat I see that there is particular ip that tries to ...
2
votes
0answers
226 views
Windows netstat vs WMIC bytes sent/received difference
I'm trying to understand the difference between the bytes sent/received values returned by both netstat and wmic on Windows. I'm having a hard time finding an explanation for the significant variation....
0
votes
1answer
292 views
UDP connections with no foreign address
Ubuntu 14.04
$ netstat -anu | less
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 0.0.0.0:...
-1
votes
1answer
101 views
Check Used Ports on Linux without Command [closed]
Is there a way to check Used Ports on Linux without commands, I mean checking files or so on ?
0
votes
0answers
462 views
Digital Ocean - Outgoing DOS attack
noob here.
My droplet has experienced an outgoing DOS attack, as informed by Digital Ocean and networking has been disabled.
This has happened twice in the last two days. Previous droplet also was ...
2
votes
1answer
358 views
Opening A Port In Redhat Enterprise Linux Fails
I have a veritas backup server (windows server 2012) that I use for backup. One of the server I need to backup (Redhat Enterprise Linux 5.9) is failing to communicate with my backup server. I have ...
1
vote
1answer
556 views
How to deal with TCP connections attack on Linux
My server is being flooded until apache becomes non-responsive, and I need some help finding and blocking the responsible IP address(es).
Normally, I don't have more than 150 connections. Now I have ...
0
votes
1answer
2k views
Too many TIME_WAIT connections on mysql from an outside host
My netstat is showing over 2,000 mysql connections with the state of TIME_WAIT that seems to be stuck and won't go away. It's been like that for several hours and many of the connections are coming ...
1
vote
0answers
611 views
In the output of netstat -r, what is the meaning of the “Netif” column and how does it differ to the “Gateway” column?
I can find virtually no documentation of the meaning of the column "Netif" in the output of netstat -rn. Googled for it, searched through the netstat(1) and route(8) man pages and found the following ...
1
vote
1answer
75 views
How can destination addresses 132.148.77.28 and 132.148.77.28/32 be use different network interfaces for routing?
The output of netstat -rn on my FreeBSD virtual machine shows that:
Internet:
Destination Gateway Flags Netif Expire
default 10.195.51.254 UGS vtnet0
10....
0
votes
1answer
95 views
What application is connecting to a remote site?
I can see with Wireshark that every 5 minutes I have a connection from my computer to ip 165.254.162.243 on udp/8253. This has been going for months. I cannot identify what application or process is ...
4
votes
2answers
673 views
Heavy TCP traffic on loopback
While trying to generate some test traffic on my loopback interface, I noticed there was so much noise there that the output from Wireshark was essentially useless, with tons of SYN/RST, ACK packets ...
0
votes
2answers
87 views
No webserver running, but replying to packets on ports 80 and 443
I see from iptables that my Centos 7 machine is receiving and sending out packets on ports 80 and 443. I don't have a webserver running, and netstat returned nothing for those ports.
Is this normal?
0
votes
0answers
73 views
Why alot of netstat poiting to external url
Our server was almost like being DDOS. When doing netstat -a , I saw something that I cannot understand (maybe due to my very limited knowledge)
root@NC-PH-0456-19:~# netstat -a
Active ...
0
votes
1answer
2k views
Server 2012 R2 ephemeral ports all slowly being bound
One of our remote desktop session host servers has started to refuse connection every few days, and upon investigation, it seems it is exhausting available ephemeral ports.
This was identified by ...
2
votes
1answer
172 views
What is running on port 49181 Windows 7
I have an application that relies on port 63000 for communicating with other devices over the network.
Some while ago this app stopped working on the PC.
I tried all sorts of firewall configs, ON/...
0
votes
1answer
536 views
Linux 'ss' command - TCP connections
I am getting below output/summary while running few gatling & AB perf test as a result of command -
$ ss -stplu
Output -
Total: 517 (kernel 0)
TCP: 11261 (estab 3, closed 11254, orphaned 1, ...
0
votes
1answer
1k views
Getting current connections from nginx/access.log
Hello im looking for command like this
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
But based on activity from /var/log/nginx/access.log
Im aware that access.log can't ...
2
votes
2answers
59 views
Source and destination servers showing different number of established TCP connections
I have a JBoss app server and a Postgres database server on different machines. I'm troubleshooting TCP connections between them (because the app keeps running out of database connections).
I'm ...
0
votes
1answer
303 views
Route Add not taking effect Windows Server 2012
I'm trying to route traffic to a specific subnet through a specific device. I've added the route successfully, yet any time I run a trace route to an IP on that subnet, it is not routing through the ...
2
votes
0answers
1k views
Can't bind UDP socket but port is free
I've been struggling for a while now with this so maybe someone here is able to help me.
I'm setting up a CS:GO server that's going to be running on port 27059.
(This is a copy&paste from a ...
1
vote
0answers
249 views
Why netstat -p doesn't show PID of established connections?
I have some REST service which is listening on tcp/8051
I'm querying this service with curl in infinite loop from the same host:
while true; do curl --header "Authorization: Bearer ...
0
votes
1answer
147 views
Irresponsive nginx while doing “nginx reload”
While reloading nginx, I started getting errors in messages log "possible SYN flooding on port 443", and it seems like nginx becomes completely irresponsive at that time (quite for a while), cause ...
1
vote
0answers
30 views
netstats shows my own server is hitting a server its not supposed to know about
On AWS I have a few dedicated servers that do image processing, and they seem to get high traffic and fail.
When running
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
I ...
0
votes
1answer
1k views
Check number of connections to webserver port 80 AND 443
As the title says how would one check the number of open connections to a webserver on port 80 and 443?
I'm currently using this oneliner to get the number of open connections per ipaddress from port ...
0
votes
2answers
53 views
Port Scanning Large Sets of Targets
1)How would you check to see if a list of ~10000 IPs if they have port 80 open?
2)How would you go about the same scenario but with a port range?
3)How would you check a list of 10000 IPs to see ...
1
vote
1answer
904 views
PID 4 Using Port 80 - IIS Unable To Bind
So I've been having a problem where I can't use localhost:80 on IIS
So I ran this:
> netstat -ano | find "0:80"
And got:
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4
...
