Questions tagged [netstat]
netstat is a tool for viewing active network connections, listeners and sockets.
326
questions
286
votes
5
answers
380k
views
What's the difference between IP address 0.0.0.0 and 127.0.0.1?
I know that 127.0.0.1 ~ 127.255.255.254 are the loopback IP addresses for most modern operating systems, and these IP addresses can be used to refer to our own computer.
But what's 0.0.0.0? It seems ...
- 3,057
53
votes
4
answers
215k
views
How do I make cURL use keepalive from the command line?
I'm trying to verify that HTTP persistent connections are being used during communication with a Tomcat webserver I've got running. Currently, I can retrieve a resource on my server from a browser (e....
- 703
48
votes
7
answers
84k
views
How to find other end of unix socket connection?
I have a process (dbus-daemon) which has many open connection over UNIX sockets. One of these connections is fd #36:
=$ ps uw -p 23284
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME ...
user13185
41
votes
7
answers
63k
views
netstat shows a listening port with no pid but lsof does not
This question is similar to Network port open, but no process attached?
I've tried everything from there, reviewed the logs, etc... and can't find anything.
My netstat shows a TCP listening port and ...
- 1,239
39
votes
7
answers
261k
views
Huge amount of TIME_WAIT connections says netstat
Okay, this is creeping me out - I see about 1500-2500 of these:
root@wherever:# netstat
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost:...
- 599
31
votes
6
answers
57k
views
Network port open, but no process attached?
I have a weird situation going on with an open network port. My main question is, why would there not be a program associated with an open TCP port:
netstat -ln --program
Active Internet connections (...
- 1,897
28
votes
5
answers
104k
views
Netstat continuous refresh (watch changes the output)
I am using this simple command to monitor connections (to deal with some recent DoS attacks) on my Debian server:
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
How do I ...
- 381
28
votes
9
answers
95k
views
How do I get rid of sockets in FIN_WAIT1 state?
I have a port that is blocked by a process I needed to kill. (a little telnet daemon that crashed).
The process was killed successfully but the port is still in a 'FIN_WAIT1' state. It doesn't come ...
- 1,471
24
votes
5
answers
55k
views
netstat -ntap doesn't show pid/process name for some connections?
I have ubuntu/hardy server, with kernel 2.6.24-23-server and netstat:
# netstat --version
net-tools 1.60
netstat 1.42 (2001-04-15)
The problem is that we have a lot of ESTABLISHED connections that ...
user13185
17
votes
10
answers
97k
views
Port 80 is being used by SYSTEM (PID 4), what is that?
I am trying to use port 80 for my application server, but when I perform "netstat -aon" I get
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4
When I look up the process in ...
GiH
14
votes
5
answers
32k
views
linux : netstat listening queue length
Is there a way to view queue length on listening socket under Linux, the same way as netstat -L outputs for FreeBSD? I.e. you can see X/Y/Z in netstat -L output, but netstat under Linux doesn't ...
- 381
14
votes
2
answers
64k
views
How to make netstat on Linux only show OUTBOUND tcp connections?
My ubuntu server is infected and there is a process making a bunch of HTTP requests to a bunch of websites (sucks!). I have added the following to my firewall (UFW):
sudo ufw deny out proto tcp to ...
- 141
14
votes
1
answer
11k
views
Netstat hangs: why?
Sometimes (not too often at all) when I type "netstat", it takes over 5 seconds to return. While other times is instantaneous.
I have been observing this for weeks on my server (CentOS 6.4), but I ...
- 367
13
votes
3
answers
7k
views
Semantics of :: and 0.0.0.0 in dual-stack OSes
Back in the IPv4-only days, a LISTEN connection showing in netstat as listening on 0.0.0.0 would respond to connections on any IPv4 interface in the system.
As I understand it, the new IPv6 idiom :: ...
- 2,844
13
votes
2
answers
39k
views
Check nginx active connection without HttpStubStatusModule
We want to check the number of active connections without the module HttpStubStatusModule being installed.
What would be the equivalent Linux command?
As a base line, we test on a machine with ...
- 2,175
13
votes
4
answers
8k
views
TCP monitoring on a server: comparing netstat vs lsof?
I'm monitoring the TCP stack on a server hoping to generically infer problems with application on the box.
My first inclination is to measure the number of sockets in all reported states (LISTEN,...
- 1,572
12
votes
3
answers
16k
views
In the output for netstat what does the [::] mean?
In the results for netstat what does the [::] mean?
example
[::]:ssh [::]:* LISTEN
- 171
12
votes
3
answers
50k
views
How to kill a TCP connection using tcpkill utility
I'm trying to kill an ESTABLISHED TCP connection using tcpkill. The connection is an open HTTPS connection. It appears on netstat as:
tcp 0 0 X.X.X.X:55601 X.X.X.X:https ...
- 223
11
votes
3
answers
8k
views
How to catch DNS request using 'netstat' in Unix
I am working in a bank where 'netcat' is not there. I am having problem wherein one DNS server of the two going down is causing impact. In order to troubleshoot, I need to catch the request (incoming ...
- 177
10
votes
1
answer
17k
views
HTTPD listening in IPv6, according netstat, but reacheable in IPv4
Using Openstack, I have a Web GUI (horizon) hosted on my server (HTTPS).
When I do a netstat -lt | grep https, I have:
tcp6 0 0 [::]:https [::]:* LISTEN
...
- 205
10
votes
4
answers
44k
views
Running lsof -i shows a lot of connections in CLOSE_WAIT ? Should I worry
So I am running lsof -i | wc -l periodically and it is telling me that out of 420 lines, between 240 and 255 are in CLOSE_WAIT state. How does TCP connections enter this state?
Should I be worried ...
- 203
10
votes
2
answers
23k
views
lots of packets pruned and packets collapsed because of socket buffer low/overrun
i've set up a test machine (debian squeeze 2.6.32 on a linode 2048 machine) that interact with an api that returns large chunks of json. It calls the API 3000/minutes asynchronously, the api is ...
- 3,086
10
votes
2
answers
4k
views
Where are my TIME_WAITs on Mac OS X?
No TIME_WAITs on Mac OS X
Normally, when a TCP connection is closed, the socket on the side where close() is called first is left in the TIME_WAIT state.
When one of the peers is a Mac OS X (Lion) ...
- 267
9
votes
4
answers
43k
views
Showing date/time in netstat
Is it possible to have netstat show the date/time the connection was established? Is this information even stored anywhere in Linux?
- 1,276
9
votes
1
answer
33k
views
Too many established connections left open
I have a (probably quite old) CentOS 4.5 server with a custom java application running inside.
I found the application was crashing after some running time and found it was handling 1024 connections ...
- 391
8
votes
1
answer
106k
views
Avoid TIME_WAIT connections [duplicate]
When I use netstat command it shows..
tcp 0 0 localhost:18056 localhost:mysql TIME_WAIT
tcp 0 0 localhost:16683 localhost:mysql ...
8
votes
5
answers
11k
views
Get number of TCP established connections
On a Linux server one can use netstat -tan | grep ESTABLISHED| wc -l but this will not work on a high load server with watch -n1.
Such approach works fine if the server is not very busy or the ...
- 335
7
votes
1
answer
9k
views
Port 80 being used by Microsoft-HTTPAPI/2.0
It's been quite a few days that port is being used by some strange process which i don't know Initially i thought it's related to SQL Server. I tried stopping all the services which starts from SQL :)....
- 73
7
votes
3
answers
13k
views
TIME_WAIT connections not being cleaned up after timeout period expires
I am stress testing one of my servers by hitting it with a constant stream of new network connections, the tcp_fin_timeout is set to 60, so if I send a constant stream of something like 100 requests ...
- 171
6
votes
3
answers
16k
views
netstat and ip_conntrack connection count differ by order of magnitude. Why?
in /proc/net/ip_conntrack I have:
established 3076
time_wait 4346
total 7468
and in netstat I have:
established 1051
time_wait 73
total 1165
Why is that? Where are other connections? How to figure ...
- 1,309
6
votes
1
answer
8k
views
What does "connections reset due to unexpected data" in netstat -s mean
I'm running a memcached server under heavy load from multiple web servers. While investigating some odd app level behaviour, we spotted that netstat -s on the memcached box was showing a lot of "...
- 211
6
votes
2
answers
9k
views
UDP port appears to be in use but is not shown in netstat or TCPView
I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen ...
- 283
5
votes
2
answers
10k
views
What causes “SYN to LISTEN sockets dropped”?
A quite busy proxy server has lots of "SYNs to LISTEN sockets dropped".
I learned one cause could be a too small backlog size. But in that case the "times the listen queue of a socket overflowed" ...
- 854
5
votes
1
answer
1k
views
Why is rpc.lockd obscured from netstat/lsof output?
Prologue:
On a number of machines, which happen to act as NFS clients, netstat reports two ports that are open with no PID listed for an associated daemon. Ordinarily this might be a bit concerning.
...
- 25.8k
5
votes
1
answer
6k
views
What does it mean for netstat -t
I see the help of netstat -t option says Displays the current connection offload state.
And I tried it in the windows command console.
The Offload State value display InHost.
What does Offload ...
- 151
5
votes
3
answers
5k
views
How to find full process arguments and associated listening ports?
I can execute netstat -atulpn | grep java to find all Java processes with their accompanying ports, which is great, however I would like to also have the processes full execution arguments also shown. ...
- 1,197
5
votes
2
answers
5k
views
After kill -9 process won't disappear and port is still bound
We have a Java server application running on Mac OS X.
Occasionally this application has become unresponsive, and we have resorted to killing it with kill -9. However, the process doesn't disappear; ...
5
votes
2
answers
1k
views
Early warning of port exhaustion in Linux
AFAIK, port exhaustion happens when a host is trying to establish a lot of connections to another server and the sessions used up all the available ephemeral ports. e.g.
192.168.1.1:port -> 10.20....
- 181
5
votes
3
answers
8k
views
How found suspect connection in a netstat output?
It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ?
...
4
votes
1
answer
6k
views
cURL can connect to localhost but browser cannot
My system is Win10 with WSL2, I ran a gogs docker container (from ubuntu in WSL):
83b2a8833235 gogs/gogs "/app/gogs/docker/st…" 17 minutes ago Up 17 minutes 0....
- 143
4
votes
2
answers
6k
views
How to know which process was using a port after it enters TIME_WAIT state?
On Linux, is there a way to figure out what process was using a port,
before it went into TIME_WAIT state.
When I use netstat -tnp I just see two end points, but no process information.
Proto Recv-Q ...
- 143
4
votes
2
answers
6k
views
(node) Hit max file limit. Increase "ulimit -n"
In Ubuntu 9 I am receiving a message on my server that says:
(node) Hit max file limit. Increase "ulimit -n"
However, typing commands in the terminal reveals the following:
$ ulimit
...
- 857
4
votes
4
answers
19k
views
Make a process listen on 0.0.0.0 (or not 127.0.0.1)
Both boxes in question are RHEL5.
I have a python RPC server running on localhost port 8000. When a client running on the same machine tries to connect, everything works great. When a remote client ...
user24773
4
votes
2
answers
3k
views
iftop Shows Lots of Mysterious Connections - Not Showing in netstat
I've just stopped all pretty much all services except sshd on my server (Ubuntu Server 10.04), and when I run iftop I get output that looks like this:
12.5Kb 25.0Kb ...
- 163
4
votes
3
answers
327
views
Windows Server 2008/2003 - determine all "used" local network ports
I have been tasked with enabling the local firewall on 100+ servers. The systems are running many different applications using many different ports. I began with an nmap scan, but without going to ...
- 85
4
votes
1
answer
12k
views
Network Policy Server + RADIUS not listening on any ports for Windows Server 2019
I must be missing something basic - is there some "master" switch for enabling Network Policy Server? It's not listening on any of the RADIUS ports. Detail:
Trying to setup Windows Server 2019 as a ...
- 141
4
votes
0
answers
1k
views
Find the process listening on a port (not showing in lsof)
Update:
The port was opened by NFS. I figured this out by configuring NFS to listen on a known port.
Using Ubuntu 18.04
I want to know which process or kernel function listens on UDP port 38637.
I ...
- 141
3
votes
2
answers
14k
views
How to determine which TCP/UDP ports are being opened by a given process (linux)?
I know how to do the opposite (find out what process has a given port open) using lsof or netstat, but extensive research on Google hasn't helped me solve the reverse problem.
I know I could use "...
- 386
3
votes
2
answers
591
views
What does "::" denote in windows netstat results?
I'm trying to understand on which interfaces a TCP port is open
Using windows netstat command I get result like :
TCP [::]:10000 MyMachineName:0 LISTENING
What does the ...
- 141
3
votes
4
answers
2k
views
Man in The Middle Attack, or something else?
I was wondering if someone could help me out with this problem.
We have a webservice that is available only through https:// port 443.
Using netstat I see that there is particular ip that tries to ...
- 143