Questions tagged [netstat]
netstat is a tool for viewing active network connections, listeners and sockets.
291
questions
0
votes
1answer
17 views
Proxy service only responding on some IP addresses (others suck on SYN_RECV)
I have a server using a proxy service (WAF etc) which forwards packets to my server.
I can see established SSL conenctions from all proxy netstat -an and the rest stuck in SYN_RECV:
tcp 0 ...
1
vote
0answers
29 views
DDOS manual mitigation using command netstat. How to determine real attackers?
When my server is slow, I have been told to run this command and check if someone is making a request of SYN_RECV to slow down my server:
netstat -npt | grep SYN_RECV | awk '{print $5}' | grep -Eo '(...
0
votes
1answer
26 views
netstat how to exclude localhost from the result when using grep
When I run this command in my terminal:
netstat -an | egrep ":80|:443" | sort
I got this following output:
tcp 0 0 172.104.10.125:48310 172.104.10.125:8081 TIME_WAIT
tcp ...
1
vote
2answers
58 views
How can a server accept incoming traffic to port 443 if it isn't listed in netstat?
I have a server that is currently accepting HTTPS requests and the only thing that shows with netstat -plnt is this:
elijahlynn@web:~$ sudo netstat -plnt
Active Internet connections (only servers)
...
0
votes
0answers
9 views
netdata shows increase in sockets count when running netstat inside a docker container
I'm running netdata.
looking at this graph: Connection Tracker Connections (netfilter.conntrack_sockets)
I've noticed every time I run netstat I get a bump in the connection count bye the number ...
1
vote
0answers
26 views
Find the process listening on a port (not showing in lsof)
Using Ubuntu 18.04
I want to know which process or kernel function listens on UDP port 38637.
I have researched this problem and found similar questions:
https://superuser.com/questions/42843/...
0
votes
1answer
26 views
Linux service is listening and responding on ports it wasn't assigned and that don't show up in netstat
I have an Amazon Linux 1 instance that was created from a Solarwinds DPA AMI. I created this around 2 years ago. It is possible I did something weird back then to make this happen.
Today, I upgraded ...
0
votes
0answers
40 views
Diagnosing socket usage on GNU/Linux, matching data from different tools
I'm trying to understand a situation with a server I'm working on. My problem is summarized here:
[root@server ~]# cat /proc/net/sockstat
sockets: used 2338
TCP: inuse 15 orphan 0 tw 29488 alloc 438 ...
0
votes
1answer
20 views
Huge amount of imap-login netstat
When I run a netstat -plantu I have a huge amount of ESTABLISHED imap-login, perhaps 50 or 60 connection.
Some connections have in column Send-Q a big number like 3211206 or 114636 for example, and ...
11
votes
3answers
2k views
How to catch DNS request using 'netstat' in Unix
I am working in a bank where 'netcat' is not there. I am having problem wherein one DNS server of the two going down is causing impact. In order to troubleshoot, I need to catch the request (incoming ...
0
votes
0answers
50 views
List active sessions from tun interface
I'm running CentOS and have a tun interface with IP subnet 10.0.0.0/24 attached for "users".
Is it possible to list current active sessions with netstat, ss or similar?
Ex. netstat something:
tun-...
1
vote
0answers
94 views
Iptables rule for limiting connections per ip
I'm usig the following iptable rule to limit the amount of simultaneous connections to 1 connection per ip, on port 4387.
/sbin/iptables -A INPUT -p tcp --syn --dport 3387 -m connlimit --connlimit-...
0
votes
0answers
32 views
netstat result pid truncated column
Running
netstat -p
in Debian 9 i get truncated PID/Process name column on terminal, like:
unix 2 [ ] STREAM CONNECTED 836933 7709/sshd: user [pr
it's cut after 100 ...
0
votes
1answer
58 views
Using netsh or netstat (or other native tool) to display UDP traffic to Windows server from given host
We have a Windows server that we suspect is not receiving UDP traffic from a Linux server. We've been able to establish, using tcpdump, that the Linux server is sending UDP traffic and we would like ...
0
votes
1answer
31 views
Filter ss process output without using grep
ss -p can give the process name, process id (PID) and the file descriptor associated with the connection.
Example: ss -tuanp
[...]
tcp ESTAB 0 0 x.x.x.x:59594 x.x.x.x:993 users:(("...
1
vote
0answers
47 views
IP Show on netstat -n
Could someone with more experience help me in this?
I have an idea in my head and i've been trying to put it into practice.
I have two machines, one where the application is hosted (I'll call it "...
0
votes
0answers
11 views
Netstat ouput without PID, what does that mean? [duplicate]
I am trying to work out what is binding to port 80 on my machine.
I use
netstat -tulpn
and the output gives a line:
Proto Recv-Q Send-Q Local Address Foreign Address State ...
1
vote
0answers
13 views
Duplicate Local Port in Virtual Guest's /proc/net/tcp
I'd like to understand the following two entries in my VirtualBox's guest's /proc/net/tcp:
6: 00000000:18EB 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 9581 1 ...
2
votes
0answers
661 views
Network Policy Server + RADIUS not listening on any ports for Windows Server 2019
I must be missing something basic - is there some "master" switch for enabling Network Policy Server? It's not listening on any of the RADIUS ports. Detail:
Trying to setup Windows Server 2019 as a ...
1
vote
1answer
35 views
Local webserver with long response time
We have set up a new infrastructure and all our Laptops/PCs have a the same error:
When trying to open a website from a local webserver, it takes between 10 and 30 seconds. During this time it does ...
3
votes
2answers
66 views
What address should the client connect the socket to [duplicate]
SOLVED
SOLUTION: I tried the connection with a little server program and it works perfectly fine. I could connected it to 10.195.5.53. My problem is within the software of my client program it has ...
2
votes
1answer
824 views
Netstat and ss doesn't see connection
I'm trying to find which application running on Kubernetes cluster is using a specific port to communicate with RabbitMQ cluster. On RabbitMQ I see that connection is coming from 192.168.1.10:34226. ...
0
votes
0answers
149 views
CENTOS 7 - Auto block IP with null routes
Whenever I notice overload on my media (videos) server, I check for ddos with this command from netstat:
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
It shows currently ...
0
votes
1answer
454 views
Remove tcp entry from netstat -a
I have a rather strange issue and no matter what I do or search, I cannot rectify it and have now decided to seek help here initially.
I have a cluster of servers, about 10 clustered together.
A few ...
0
votes
0answers
320 views
Why can't I ping 127.0.0.1 from some network interfaces?
I'm on OS Sierra.
This is (part of) what I get on ifconfig
...
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether 98:01:a7:b4:91:63
inet6 fe80::4e:52ae:9fa8:...
1
vote
1answer
472 views
netstat vs nmap to find IPs in a local network
I'm in a local network : IPv4 shared address space (100.x.x.x). Connected to a wifi hotspot. Ip ranges : 100.76.164.0/23
When I run :
nmap 100.76.164.0/23 : It says all the hosts are down
netstat -...
2
votes
1answer
474 views
netstat says connection in SYN_SENT but tcpdump captures no data
I'm debugging a ldap problem after ldap client machine upgraded to ubuntu 18.04. Trying to figure out where the problem is, and I noticed the outbound connection is in SYN_SENT, but when I use tcpdump ...
0
votes
0answers
268 views
Remote Client is unable to connect to TCP Server on VPS (Getting 10060 error)
I have searched all over the internet for the solution. Unfortunately, I could not get any working solution yet. Here is the story.
I am running TCP server for small communication application on the ...
1
vote
1answer
426 views
netstat shows connected socket with path to it, but path doesn't exist
Im inside a docker container and ran netstat -x | grep docker
which got me the:
unix 3 [ ] STREAM CONNECTED 62288711 /var/run/docker.sock
unix 3 [ ] STREAM ...
-1
votes
2answers
66 views
how to get file download connections on linux
I have a site with video content (mp4 files).
When people are watching videos, they are downloading video files from my site. I want to know the number of the active connections via the linux ...
0
votes
1answer
123 views
On a web server, is it normal to see a thousand connections coming from one user?
When I saw so many connections from one IP (by using netstat), I thought it's bot.
(The website is not popular so it's very unlikely to be multiple users behind one IP.)
But I checked apache access ...
0
votes
0answers
178 views
Collectd won't open listener
So I've been stuck with this for sometime now. I want to use collectd with graphite. Im using centos 7. I've made the necessary changes in collectd.conf as seen below:
[root@relay-1 ~]# grep -v "#" /...
2
votes
1answer
105 views
why are there are so many svchost established connections to Isilon?
Our client has a Isilon (used only for smb) with few nodes attached to it. When I run TCPView I don't understand why svchost service established the connection and why there're so many of them:
And ...
0
votes
1answer
303 views
Uderstanding netstat output
When I run netstat -b on Windows 10
I get lots of results of similar nature
TCP 127.0.0.1:64248 LocalHostName:64249 ESTABLISHED
[w3wp.exe]
TCP 127.0.0.1:64249 LocalHostName:...
1
vote
1answer
100 views
Why is kjournald showing up 700 times in `netstat`?
AFAIK, kjournald is not a network program, but a program that deals with the journal of EXT3 (I am running EXT4 on Ubuntu 16.04). Still, when running sudo netstap -tapn it shows up almost 700 times, ...
1
vote
0answers
244 views
How to configure Linux to close the connection if Send-Q is never sent?
There is a TCP client-server connection. The application on the server is sending data regularly. Client machine is then reset physically. Netstat shows Send-Q on the server is filling up, the ...
0
votes
1answer
195 views
weird netstat output on netscaler
We have a VPX-1000 netscaler. When traffic suddenly increases our website goes offline and doesn't response to requests but our netscaler load is fine (cpu %40 ram %50 4 cores 4gb). After incident ...
1
vote
1answer
3k views
Debian 8 - getnameinfo Failed Error - netstat
I am experiencing a error/warning when running any netstat command on my Debian 8 machine.
One of the commands:-
netstat | grep http | wc -l
The result:-
getnameinfo failed
getnameinfo ...
1
vote
1answer
2k views
What are all these DGRAM items in NETSTAT?
I am assigned a server that has been sending tons of data ourside and isn't used. So, it is most likely compromised. Nothing really seems to be out of order on the server except, they're miles and ...
0
votes
1answer
2k views
Docker networking IPv6 exposed
I'm running a small arm board providing some services within our local network. As I try to understand the ipv6 support of docker, I am quite confused about the results of my first tests.
My network ...
0
votes
1answer
566 views
“0/2” IPv4 destination in “netstat -nr” command on Mac OS X to view host routing table
I'm using the command "netstat -nr" to view the host routing table on a Mac OS X system, and here's the output I'm getting:
Routing tables
Internet:
Destination Gateway Flags ...
-1
votes
1answer
68 views
syslog for netstat to get no. of connection from each IP range
I have a server which keeps on receiving request from two other servers from different IP ranges. I need to know how can I setup a cronjob which keeps on checking number of connection made by each ...
0
votes
0answers
119 views
Track down application/process causing computer broacasting destination 255.255.255.255 port 0
We have installed Untangle and we see many broadcasts from 1 IP (client Windows 7). Almost every minute it is broadcasting to 255.255.255.255 port 0.
I would like to know how to trace the source of ...
0
votes
1answer
168 views
I cannot ping to destination IP even after adding a ip tunnel
So I have a virtual device with ip 192.168.16.15/24(device X). I'm trying to ping this from another device 10.64.95.120/24(device A). This virtual device(device X) is created on another server 10.64....
0
votes
2answers
600 views
openVPN and myhttpd on port 433
I'm trying to set up OpenVPN to listen on port 443 on my Asustor NAS, and then pass all HTTPS traffic to Apache, by using the port-share option based on:
OpenVPN port-share with Apache/SSL
However i'...
2
votes
4answers
1k views
Man in The Middle Attack, or something else?
I was wondering if someone could help me out with this problem.
We have a webservice that is available only through https:// port 443.
Using netstat I see that there is particular ip that tries to ...
3
votes
0answers
544 views
Windows netstat vs WMIC bytes sent/received difference
I'm trying to understand the difference between the bytes sent/received values returned by both netstat and wmic on Windows. I'm having a hard time finding an explanation for the significant variation....
0
votes
1answer
670 views
UDP connections with no foreign address
Ubuntu 14.04
$ netstat -anu | less
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 0.0.0.0:...
-1
votes
1answer
290 views
Check Used Ports on Linux without Command [closed]
Is there a way to check Used Ports on Linux without commands, I mean checking files or so on ?
0
votes
0answers
754 views
Digital Ocean - Outgoing DOS attack
noob here.
My droplet has experienced an outgoing DOS attack, as informed by Digital Ocean and networking has been disabled.
This has happened twice in the last two days. Previous droplet also was ...
