Questions tagged [netstat]
netstat is a tool for viewing active network connections, listeners and sockets.
319
questions
0
votes
2
answers
46
views
netstat no support on this system [closed]
in dealing with try to resolve another issue into my Ubuntu 22 OS
I need to check out the ports that tightvnc is listening on for connections.
I use this command : sudo netstat -lvp | grep vnc
BUT ...
- 103
0
votes
0
answers
21
views
fuser not listing the process even netstat and lsof list
hostserver:~# lsof | grep *:6343
sflowtool 979324 root 3u IPv6 1443815323 0t0 UDP *:6343
hostserver:~# netstat -ntlup | grep 6343
udp6 0 ...
- 101
1
vote
1
answer
40
views
What does "no ports" on netstat -s mean?
On Windows server 2016, when I execute, in a cmd prompt, "netstat -s" I get a bunch of statistics. One of those is "No Ports".
What does this mean? Is this the number of times ...
- 798
0
votes
0
answers
68
views
Can't create a pseudo network interface on Debian 11
I have a KVM based Debian 11 (bullseye) VPS with internet access on eth0 network adapter. The public IP has been assigned by DHCP. The IPs and Routes are as what follows:
ifconfig and iptable BEFORE ...
-1
votes
1
answer
40
views
Take NetStat Dump After Every X Minutes
We have a lot of port exhaustion issues recently. I was reading https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/tcp-ip-port-exhaustion-troubleshooting?source=recommendations
@...
- 337
0
votes
1
answer
102
views
NetStat Group By Process Id and Show Count
Is there any way to group the output given by netstat into process? I am running netstat -ano and doing manual count to know which process is using how many ports. I am using Windows Server.
We have ...
- 337
0
votes
1
answer
45
views
What does `netstat -y` on Windows do?
From the help page of Windows netstat, I got this:
-y Displays the TCP connection template for all
connections.
Cannot be combined with the other options.
Google results are all same ...
0
votes
0
answers
53
views
how to continues netstat a port and save it to text file with time stamp for each netstat
I am using a system which is integrated to other system using a specific port and recently I am facing multiple interruption in the integration, and I need to monitor the port "48823" for a ...
- 1
2
votes
0
answers
138
views
How to tell whether a linux tcp socket had recent activity?
Most of the time, when changing or upgrading a network service, I would do this during maintenance hours but some services are rarely used so it is tempting to just check whether it is currently in ...
- 121
0
votes
0
answers
272
views
Why NFS is listening to a port but not showing the process name, is there any security risk if no firewall is set?
I'm using ubuntu 22.04 and have mounted an NFS storage, here is my fstab file
ftpback-bhs5-26.ip-149-56-30.net:/export/ftpbackup/ns524316.ip-xxx-xxx-xxx.net /media/backup nfs vers=4.0 0 0
When ...
- 163
1
vote
0
answers
93
views
How to identify which os process is establishing a proxy connection
Platform: Red-Hat 7
I hope you can help me with this. I've been told that one proxy server we are using is going to be decommissioned in the following days. I've tried to use netstat in order to ...
0
votes
1
answer
756
views
Nginx change default IP form 0.0.0.0 to pecific IP
I have nginx running as a web server.
The virtual host have the IP specific configuration with IP addresses listed, however whtn I check netstat Nginx is litening on 0.0.0.0:80. I would like to change ...
- 215
5
votes
2
answers
653
views
Early warning of port exhaustion in Linux
AFAIK, port exhaustion happens when a host is trying to establish a lot of connections to another server and the sessions used up all the available ephemeral ports. e.g.
192.168.1.1:port -> 10.20....
- 181
0
votes
0
answers
185
views
How to block flooding "empty" connections from single IP
Right now netstat lists 200 - 4000 connections to the same IP in India. Seems like some kind of flooding attack to me.
e.g:
tcp 0 0 [removed] 182.65.238.[removed].in-:mysql TIME_WAIT
I've ...
- 1
2
votes
1
answer
853
views
Show TCP keepalive status in Windows?
Using netstat -to on a Linux system shows the status of tcp keepalive for a socket like this:
Proto Recv-Q Send-Q Local Address Foreign Address State Timer
tcp6 0 0 ...
- 153
1
vote
2
answers
400
views
How to find a malicious TCP program using netstat [closed]
I am trying to do a homework for a lab but have a quick question.
How do I find a malicious TCP service that is still running and the adversary has achieved persistence by creating a systemd service?
...
2
votes
1
answer
235
views
Dovecot claims ports are in use, netstat disagrees
Attempting to start dovecot gives me this:
Apr 28 13:37:00 master: Error: service(pop3-login): listen(*, 110) failed: Address already in use
Apr 28 13:37:00 master: Error: service(pop3-login): listen(*...
- 71
3
votes
2
answers
568
views
netstat reports UDP ports with no owning process
When I run netstat -avp udp I get a slowly growing number of ports. It grows about 100 an hour but the rate varies considerably.
When I close the process, the ports do not disappear from the list. ...
- 131
0
votes
1
answer
127
views
Exim established many connections to strange ips
I installed VestaCP and used their mail server for my domain mails. But when I run netstat on my server,it shows some strange connections. There are no problems with my mail server until now, I just ...
- 115
2
votes
0
answers
766
views
Kernel TCP tuning for buffer overrun and packet collapse
We have a Nginx+Ruby application where the data between Nginx and the application are interfaced through a socket.
As part of performance improvement, when we analyzed the netstat statistics on the ...
- 143
0
votes
0
answers
100
views
Showing all http connections in vm instance
I have a Google Cloud VM instance running Debian and a dockerized Apache httpd inside. I'm trying to count all the http connections in the machine.
I run this:
for i in {1..1000}; do netstat -at | wc -...
google-cloud-platform
3
votes
1
answer
4k
views
cURL can connect to localhost but browser cannot
My system is Win10 with WSL2, I ran a gogs docker container (from ubuntu in WSL):
83b2a8833235 gogs/gogs "/app/gogs/docker/st…" 17 minutes ago Up 17 minutes 0....
- 133
0
votes
1
answer
161
views
New netstat Ubuntu 20.10
I have been using netstat 1.42 without any problem but yesterday I installed a fresh VPS and when I try to set commands netstat does not show anything.
I use this command to see all active TCP ...
0
votes
1
answer
170
views
Want to enable Windows Server firewall - how to know what ports to open
For added security, we're thinking of enabling the firewalls on our 2016 and 2019 servers. Currently, they're all behind our edge router/firewall, and every server has its firewall disabled. Sometimes,...
- 123
0
votes
1
answer
721
views
Ngnix Closes The Connection Doesn't Return 301
struggling to get my hosts to work on port 80/HTTP and redirect to HTTPS. Discovered this when I gave out a URL and they said it didn't work but noticed a direct link to the site did work. I've done ...
0
votes
0
answers
123
views
Why two TCP connections to mysql server?
When I connect to a mysql server via a client, it seems to create two new TCP connections each time, for example doing:
$ netstat -a |grep mysql
# tcp4 0 0 lmy.att.64710 ec2-54-00.mysql ...
- 939
0
votes
0
answers
452
views
OpenVPN Access Server has a lot of listening ports
I have setup OpenVPN Access Server for a small private cloud network.
It works great, but I am wondering about all these 900 ports showing up in netstat from part of the system called openvpn-openss. ...
- 113
1
vote
0
answers
207
views
Get information about socket of unknown domain
The output of lsof (revision: 4.87) on centos 7.8.2003 shows:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
java 30858 xxxx 841u sock 0,7 ...
- 204
0
votes
0
answers
637
views
netstat shows a listening port with no pid and can't find pid with rpcinfo and ss and lsof
I tried bind nc on port 41120, but it said port has already been used. So I want to find out which process binded this port and if I can kill it. I executed netstat -taupen| grep 41120 and it shows ...
- 195
0
votes
2
answers
175
views
Netstat port status
How can I see all ports and their status on my pc using netsat? (All 2^16 ports) And how can I list apps that have an open port in transport layer of my computer with application name and it's port? ...
- 105
0
votes
1
answer
632
views
what are the options to close manual the port correctly or release the port on rhel machines?
we have redhat 7.5 server
we are suspect that port 50070 not closed correctly by the service , ( we check by netstat and PID not found ) but from the log we can see that port is in use
so we try to do ...
- 479
1
vote
1
answer
531
views
SAMBA netstat local address 0.0.0.0
Trying to run samba AD DC but I'm stuck. After created domain provision, I defined resolv.conf:
cat /etc/resolv.conf
nameserver 10.99.0.30
search example.com
Service running:
samba-ad-dc.service - ...
- 49
0
votes
1
answer
185
views
New and Unknown Netstat Entries
OS = Debian 10.
When I run netstat -natp, I have two unidentified entries which are concerning.
tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 24310/redis-server
...
- 101
0
votes
1
answer
169
views
Proxy service only responding on some IP addresses (others suck on SYN_RECV)
I have a server using a proxy service (WAF etc) which forwards packets to my server.
I can see established SSL conenctions from all proxy netstat -an and the rest stuck in SYN_RECV:
tcp 0 ...
- 1,140
3
votes
1
answer
462
views
DDOS manual mitigation using command netstat. How to determine real attackers?
When my server is slow, I have been told to run this command and check if someone is making a request of SYN_RECV to slow down my server:
netstat -npt | grep SYN_RECV | awk '{print $5}' | grep -Eo '(...
- 137
0
votes
1
answer
1k
views
netstat how to exclude localhost from the result when using grep
When I run this command in my terminal:
netstat -an | egrep ":80|:443" | sort
I got this following output:
tcp 0 0 172.104.10.125:48310 172.104.10.125:8081 TIME_WAIT
tcp ...
- 137
1
vote
3
answers
3k
views
How can a server accept incoming traffic to port 443 if it isn't listed in netstat?
I have a server that is currently accepting HTTPS requests and the only thing that shows with netstat -plnt is this:
elijahlynn@web:~$ sudo netstat -plnt
Active Internet connections (only servers)
...
- 141
4
votes
0
answers
1k
views
Find the process listening on a port (not showing in lsof)
Update:
The port was opened by NFS. I figured this out by configuring NFS to listen on a known port.
Using Ubuntu 18.04
I want to know which process or kernel function listens on UDP port 38637.
I ...
- 141
0
votes
1
answer
280
views
Linux service is listening and responding on ports it wasn't assigned and that don't show up in netstat
I have an Amazon Linux 1 instance that was created from a Solarwinds DPA AMI. I created this around 2 years ago. It is possible I did something weird back then to make this happen.
Today, I upgraded ...
- 3,448
0
votes
1
answer
136
views
Huge amount of imap-login netstat
When I run a netstat -plantu I have a huge amount of ESTABLISHED imap-login, perhaps 50 or 60 connection.
Some connections have in column Send-Q a big number like 3211206 or 114636 for example, and ...
- 149
11
votes
3
answers
6k
views
How to catch DNS request using 'netstat' in Unix
I am working in a bank where 'netcat' is not there. I am having problem wherein one DNS server of the two going down is causing impact. In order to troubleshoot, I need to catch the request (incoming ...
- 167
0
votes
0
answers
173
views
List active sessions from tun interface
I'm running CentOS and have a tun interface with IP subnet 10.0.0.0/24 attached for "users".
Is it possible to list current active sessions with netstat, ss or similar?
Ex. netstat something:
tun-...
- 409
1
vote
0
answers
467
views
Iptables rule for limiting connections per ip
I'm usig the following iptable rule to limit the amount of simultaneous connections to 1 connection per ip, on port 4387.
/sbin/iptables -A INPUT -p tcp --syn --dport 3387 -m connlimit --connlimit-...
- 11
0
votes
1
answer
704
views
Using netsh or netstat (or other native tool) to display UDP traffic to Windows server from given host
We have a Windows server that we suspect is not receiving UDP traffic from a Linux server. We've been able to establish, using tcpdump, that the Linux server is sending UDP traffic and we would like ...
- 101
0
votes
1
answer
239
views
Filter ss process output without using grep
ss -p can give the process name, process id (PID) and the file descriptor associated with the connection.
Example: ss -tuanp
[...]
tcp ESTAB 0 0 x.x.x.x:59594 x.x.x.x:993 users:(("...
- 291
1
vote
0
answers
314
views
IP Show on netstat -n
Could someone with more experience help me in this?
I have an idea in my head and i've been trying to put it into practice.
I have two machines, one where the application is hosted (I'll call it "...
- 11
1
vote
0
answers
51
views
Duplicate Local Port in Virtual Guest's /proc/net/tcp
I'd like to understand the following two entries in my VirtualBox's guest's /proc/net/tcp:
6: 00000000:18EB 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 9581 1 ...
- 111
3
votes
1
answer
8k
views
Network Policy Server + RADIUS not listening on any ports for Windows Server 2019
I must be missing something basic - is there some "master" switch for enabling Network Policy Server? It's not listening on any of the RADIUS ports. Detail:
Trying to setup Windows Server 2019 as a ...
- 131
1
vote
1
answer
50
views
Local webserver with long response time
We have set up a new infrastructure and all our Laptops/PCs have a the same error:
When trying to open a website from a local webserver, it takes between 10 and 30 seconds. During this time it does ...
- 11
3
votes
2
answers
155
views
What address should the client connect the socket to [duplicate]
SOLVED
SOLUTION: I tried the connection with a little server program and it works perfectly fine. I could connected it to 10.195.5.53. My problem is within the software of my client program it has ...
- 31