Questions tagged [netstat]
netstat is a tool for viewing active network connections, listeners and sockets.
327
questions
1
vote
3
answers
3k
views
Linux : restricting outgoing on an application basis
I typed :
netstat -atlpvn
and noticed that applications like gedit and python had foreign addresses outside the network (the network being a single computer connected to the internet).
Is there ...
2
votes
4
answers
4k
views
Netstat: How to know if it's Human or Bot/Spider/DDOS
I'm using the following command to check how many connections I have from a single ip
netstat -anp |grep ':80' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
If it's DDOS attack(500+ ...
1
vote
2
answers
17k
views
Understanding the netstat command output
I used netstat command recently, and the output is below.
netstat -a
proto local address foreign address state
tcp 127.0.0.1:1107 avinash-pc:0 listening
tcp ...
1
vote
1
answer
395
views
Process killing trouble
I am trying to program a server software which involves a lot of testing on java / scala platform. Whenever i compile and execute the code. It starts listening on port 80. Sometimes i need to ...
2
votes
4
answers
2k
views
netstat doesn't display full remote ip address, no ip address for ssl, port 443
We're running a Apache webserver on Arch Linux (build from May '10) and while monitoring connections with netstat we're seeing some odd connections on port 443 that don't report an IP address; is this ...
2
votes
2
answers
8k
views
analyse TCP performance by interpreting "netstat -s"
I have executed netstat -s on my dedicated server running debian. I'd like to interprete the results because I'm experiencing connectivity problems with TCP. I don't know how to read these results. ...
1
vote
1
answer
3k
views
FreeBSD netstat -di, Idrop vs Drop and drop count from NIC or kernel?
On FreeBSD what's the difference between Drop and Idrop in the netstat output?
$ netstat -di
Name Mtu Network Address Ipkts Ierrs Idrop Opkts Oerrs Coll Drop
bge0* 1500 &...
12
votes
3
answers
50k
views
How to kill a TCP connection using tcpkill utility
I'm trying to kill an ESTABLISHED TCP connection using tcpkill. The connection is an open HTTPS connection. It appears on netstat as:
tcp 0 0 X.X.X.X:55601 X.X.X.X:https ...
6
votes
3
answers
16k
views
netstat and ip_conntrack connection count differ by order of magnitude. Why?
in /proc/net/ip_conntrack I have:
established 3076
time_wait 4346
total 7468
and in netstat I have:
established 1051
time_wait 73
total 1165
Why is that? Where are other connections? How to figure ...
40
votes
7
answers
63k
views
netstat shows a listening port with no pid but lsof does not
This question is similar to Network port open, but no process attached?
I've tried everything from there, reviewed the logs, etc... and can't find anything.
My netstat shows a TCP listening port and ...
1
vote
2
answers
16k
views
Can ping an ip but does not show up in netstat?
I was wondering if someone would be able to help me with a head scratcher. We have a device that has communicated with our server but is not sending back any data.
I am able to ping the IP address ...
0
votes
1
answer
1k
views
When Does the Linux & Windows' Samba Port Connection Close?
After connecting to a samba share, then disconnecting, netstat still shows that the ports are ESTABLISHED, even when the clients are on SUSPEND, HIBERNATE, or have SHUTDOWN. Looking over the samba ...
7
votes
3
answers
13k
views
TIME_WAIT connections not being cleaned up after timeout period expires
I am stress testing one of my servers by hitting it with a constant stream of new network connections, the tcp_fin_timeout is set to 60, so if I send a constant stream of something like 100 requests ...
0
votes
2
answers
2k
views
Problem with too many local connections
I have a problem with my server (VPS). It's veeery slow.
Checking the connections with netstat, there are a lot of internal connections. I don't understand why!
It's normal all this connections?
# ...
0
votes
1
answer
2k
views
FileMaker Server not listening on Port 2399 for ODBC/JDBC
I am trying to create a ODBC connection from an OSX machine to a Filemaker server 10 using a DataDirect SeQuel Link 5.5 JDBC drive. I have ODBC/JDBC enabled on the server and I followed all of the ...
0
votes
2
answers
208
views
WinServer 2003: Cant find process holding onto ports
We have a couple of production WCF services failing to start because their ports are apparently in use by another process. I have done a netstat -ano and found the PID's that are using these ports, ...
10
votes
2
answers
23k
views
lots of packets pruned and packets collapsed because of socket buffer low/overrun
i've set up a test machine (debian squeeze 2.6.32 on a linode 2048 machine) that interact with an api that returns large chunks of json. It calls the API 3000/minutes asynchronously, the api is ...
0
votes
1
answer
3k
views
Is this normal? Multiple httpd process
I'm testing a new Server. This isnt really a peak time for my server (2pm), but still its running a bit slow, I was checking the ESTABLISHED connections using the following command:
# netstat -ntu | ...
3
votes
2
answers
12k
views
What does each field of netstat -ano mean?
tcp 0 0 219.155.32.195:8888 221.137.227.51:5943 TIME_WAIT timewait (58.45/0/0)
tcp 0 0 219.155.32.195:8888 221.137.227.51:5936 TIME_WAIT timewait (59.36/0/0)...
1
vote
1
answer
4k
views
High count packets rejects in established connections because of timestamp
I am trying to set up a Wowza media server using a Dell R710 with 24GB memory and a 10Gbit connection and all the calculations say it should be able to handle around 20k connections however when I get ...
2
votes
2
answers
2k
views
Apache many httpd process by my own server IP? eating all my Ram
Well i just bought a new dedicated server, I have no Linux experience, but i'm trying to learn.
I have been testing the server for a few days. I improve the httpd.conf my.cnf for better performance, ...
4
votes
2
answers
6k
views
(node) Hit max file limit. Increase "ulimit -n"
In Ubuntu 9 I am receiving a message on my server that says:
(node) Hit max file limit. Increase "ulimit -n"
However, typing commands in the terminal reveals the following:
$ ulimit
...
0
votes
2
answers
2k
views
How to speed up a server using netstat & httpd.conf?
I'm using netstat commands to help optimize my httpd.conf correctly.
Here are the results:
netstat -an | grep -c :80
579
netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -...
0
votes
1
answer
2k
views
How to monitor real time sendq and recvq sizes
netstat -an will give the recvq and sendq on a particular connection. When I have an application (in this case a dumb echo server) listening on a port and I put the load on and run netstat in a loop, ...
2
votes
3
answers
1k
views
netstat issue: cannot pipe output from 'netstat -c' to an nfs mount
Short version:
Netstat works fine except when I redirect output to a file in NFS.
doesn't work: netstat -c > /nfs/mount/file
works: netstat > /nfs/mount/file
works: netstat -c
works: ...
3
votes
0
answers
1k
views
Netstat Send-Q High
Am using Ubuntu Server 10.10 and when i do netstat -tuna i get the many connections with Send-Q very high, 23K, 50K, 100K. This users report that they have latency problems when connecting to the ...
48
votes
7
answers
84k
views
How to find other end of unix socket connection?
I have a process (dbus-daemon) which has many open connection over UNIX sockets. One of these connections is fd #36:
=$ ps uw -p 23284
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME ...
0
votes
2
answers
2k
views
Why can't I access my Linux FTP (vsftpd) server?
I've just installed vsftpd, and started the service. The service is running, and my netstat dump shows it (See below). I've also enabled anonymous access for good measure. However, when I try to ...
0
votes
1
answer
3k
views
Port 8080 not visible while doing netstat?
While trying to run Tomcat on my Windows 2003 OS, I am noticing that the server is not running but at the same time it is not throwing any exceptions on the console. My first hunch was that the server ...
2
votes
2
answers
941
views
Linux: How to display all sockets opened for a particular interface?
How can I display all sockets opened for a particular interface?
1
vote
2
answers
4k
views
Can't connect to local server
I'm migrating a client / server application from Linux to Windows and while the Linux version of the server works fine, the Windows version won't connect via localhost. While the program is trying to ...
3
votes
1
answer
24k
views
Lots of TIME_WAIT connections in netstat (Windows Server 2008)
I'm having some issues on a Windows 2008 server with some network connections not going through. For instance, in a web application on the server, we need to open a socket connection to another server,...
1
vote
1
answer
1k
views
netstat on fresh install of Solaris 10 update 9
I am attempting to decipher the below output
bash-3.00$ netstat -a
UDP: IPv4
Local Address Remote Address State
-------------------- -------------------- ----------
*.sunrpc ...
1
vote
2
answers
5k
views
netstat reports PID that doesn't exist - wtf and how do I close it?
I have an app that listens on port 7001, which sometimes crashes but leaves the port open. netstat reports a PID that doesn't exist. How is that possible? How can I force the port to close without ...
0
votes
1
answer
1k
views
In "The Social Network", what linux program is Mark using to monitor traffic in near real-time? [duplicate]
Possible Duplicate:
How to watch logs in real time via Terminal?
The scene where Mark is monitoring TCP/IP connections to his Facemesh website, and comments "look at all this traffic". What ...
53
votes
4
answers
214k
views
How do I make cURL use keepalive from the command line?
I'm trying to verify that HTTP persistent connections are being used during communication with a Tomcat webserver I've got running. Currently, I can retrieve a resource on my server from a browser (e....
1
vote
1
answer
4k
views
Unknown connections to foreign hosts
When I run netstat -a, a lot of connections to foreign hosts show up. It's connected to a whole subnet, ie 123.123.123.x to the port 80. How can I see what is actually going on? My server doesn't look ...
0
votes
1
answer
286
views
Netstat - Thunderbird and others work on strange ports
I'm getting this:
$ sudo netstat -alpv
tcp 0 0 comp.local:35409 ey-in-f16.1e100.n:imaps ESTABLISHED 2782/thunderbird-bi
tcp 0 0 comp.local:52950 ew-in-f16....
9
votes
4
answers
43k
views
Showing date/time in netstat
Is it possible to have netstat show the date/time the connection was established? Is this information even stored anywhere in Linux?
0
votes
3
answers
4k
views
Windows server 2008 & SQL - many connections in TIME_WAIT
When I run netstat, I get this:
TCP xxxx:65524 65.55.11.162:80 TIME_WAIT 0
There are 13941 of such lines in netstat at this point.
Server is running Windows 2008 & SQL Server ...
0
votes
3
answers
2k
views
Port listed as close-combat in netstat
Have just run netstat -A on my SQL Server and seen an established connection from one of our workstations on bmcw000340.domain:close-combat.
My google-fu is failing me and I can't find out what close-...
3
votes
1
answer
13k
views
TIME_WAIT in netstat of Apache processes
What are the meaning of the TIME_WAIT when using netstat of my web server process? I am sure the web server is not over loaded.
tcp 0 0 0.0.0.0:80 0.0.0.0:* ...
12
votes
3
answers
16k
views
In the output for netstat what does the [::] mean?
In the results for netstat what does the [::] mean?
example
[::]:ssh [::]:* LISTEN
4
votes
3
answers
326
views
Windows Server 2008/2003 - determine all "used" local network ports
I have been tasked with enabling the local firewall on 100+ servers. The systems are running many different applications using many different ports. I began with an nmap scan, but without going to ...
0
votes
2
answers
526
views
Netstat and strange activity
when i did some monitoring network activity of my server, using netstat -na, in a sec i noticed next, for me strange line:
first it was:
tcp 0 0 XXX.XXX.XXX.XXX:22 YYY.YYY.YYY.YYY:...
0
votes
3
answers
595
views
Is this hacking attempt?
on command netstat -na, between others, i'm getting next line:
tcp 0 0 XXX.XXX.XXX.XXX:48746 YYY.YYY.YYY.YYY:80 TIME_WAIT
is this some kind of hacking attempt? can you give ...
5
votes
1
answer
1k
views
Why is rpc.lockd obscured from netstat/lsof output?
Prologue:
On a number of machines, which happen to act as NFS clients, netstat reports two ports that are open with no PID listed for an associated daemon. Ordinarily this might be a bit concerning.
...
0
votes
1
answer
321
views
Finding Network Status of specific process name
I am looking for the cleanest way on linux to find the port status for a port being used by a specified program name via the command line. I have seen that netstat -p lists all pids but haven't seen ...
1
vote
3
answers
8k
views
debugging spiking netstat "failed connection attempts" with iptables
http://farm4.static.flickr.com/3305/4588110530_a60c934289_o.png
This graph is munin collecting netstat -s output.
I want to determine where the connections are coming from.
There is nothing obvious ...
1
vote
2
answers
379
views
What can I use to monitor which IP address w/name resolution is connected to each PID?
This would be for under Linux particularly.
Is there a tool out there, or a script that I could use to monitor IP connections--with name resolution--and, see which process they're connected to?
...