Questions tagged [netstat]

netstat is a tool for viewing active network connections, listeners and sockets.

Filter by
Sorted by
Tagged with
1 vote
3 answers
3k views

Linux : restricting outgoing on an application basis

I typed : netstat -atlpvn and noticed that applications like gedit and python had foreign addresses outside the network (the network being a single computer connected to the internet). Is there ...
artella's user avatar
  • 1,049
2 votes
4 answers
4k views

Netstat: How to know if it's Human or Bot/Spider/DDOS

I'm using the following command to check how many connections I have from a single ip netstat -anp |grep ':80' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n If it's DDOS attack(500+ ...
Crazy_Bash's user avatar
1 vote
2 answers
17k views

Understanding the netstat command output

I used netstat command recently, and the output is below. netstat -a proto local address foreign address state tcp 127.0.0.1:1107 avinash-pc:0 listening tcp ...
AvinashK's user avatar
  • 113
1 vote
1 answer
395 views

Process killing trouble

I am trying to program a server software which involves a lot of testing on java / scala platform. Whenever i compile and execute the code. It starts listening on port 80. Sometimes i need to ...
Aditya Singh's user avatar
2 votes
4 answers
2k views

netstat doesn't display full remote ip address, no ip address for ssl, port 443

We're running a Apache webserver on Arch Linux (build from May '10) and while monitoring connections with netstat we're seeing some odd connections on port 443 that don't report an IP address; is this ...
scoopseven's user avatar
2 votes
2 answers
8k views

analyse TCP performance by interpreting "netstat -s"

I have executed netstat -s on my dedicated server running debian. I'd like to interprete the results because I'm experiencing connectivity problems with TCP. I don't know how to read these results. ...
Joel's user avatar
  • 195
1 vote
1 answer
3k views

FreeBSD netstat -di, Idrop vs Drop and drop count from NIC or kernel?

On FreeBSD what's the difference between Drop and Idrop in the netstat output? $ netstat -di Name Mtu Network Address Ipkts Ierrs Idrop Opkts Oerrs Coll Drop bge0* 1500 &...
jon's user avatar
  • 181
12 votes
3 answers
50k views

How to kill a TCP connection using tcpkill utility

I'm trying to kill an ESTABLISHED TCP connection using tcpkill. The connection is an open HTTPS connection. It appears on netstat as: tcp 0 0 X.X.X.X:55601 X.X.X.X:https ...
Charles Salvia's user avatar
6 votes
3 answers
16k views

netstat and ip_conntrack connection count differ by order of magnitude. Why?

in /proc/net/ip_conntrack I have: established 3076 time_wait 4346 total 7468 and in netstat I have: established 1051 time_wait 73 total 1165 Why is that? Where are other connections? How to figure ...
Poma's user avatar
  • 1,309
40 votes
7 answers
63k views

netstat shows a listening port with no pid but lsof does not

This question is similar to Network port open, but no process attached? I've tried everything from there, reviewed the logs, etc... and can't find anything. My netstat shows a TCP listening port and ...
mhost's user avatar
  • 1,229
1 vote
2 answers
16k views

Can ping an ip but does not show up in netstat?

I was wondering if someone would be able to help me with a head scratcher. We have a device that has communicated with our server but is not sending back any data. I am able to ping the IP address ...
Adrian's user avatar
  • 11
0 votes
1 answer
1k views

When Does the Linux & Windows' Samba Port Connection Close?

After connecting to a samba share, then disconnecting, netstat still shows that the ports are ESTABLISHED, even when the clients are on SUSPEND, HIBERNATE, or have SHUTDOWN. Looking over the samba ...
fadmcrank's user avatar
7 votes
3 answers
13k views

TIME_WAIT connections not being cleaned up after timeout period expires

I am stress testing one of my servers by hitting it with a constant stream of new network connections, the tcp_fin_timeout is set to 60, so if I send a constant stream of something like 100 requests ...
Mark D's user avatar
  • 171
0 votes
2 answers
2k views

Problem with too many local connections

I have a problem with my server (VPS). It's veeery slow. Checking the connections with netstat, there are a lot of internal connections. I don't understand why! It's normal all this connections? # ...
Lito's user avatar
  • 265
0 votes
1 answer
2k views

FileMaker Server not listening on Port 2399 for ODBC/JDBC

I am trying to create a ODBC connection from an OSX machine to a Filemaker server 10 using a DataDirect SeQuel Link 5.5 JDBC drive. I have ODBC/JDBC enabled on the server and I followed all of the ...
Greg_the_Ant's user avatar
0 votes
2 answers
209 views

WinServer 2003: Cant find process holding onto ports

We have a couple of production WCF services failing to start because their ports are apparently in use by another process. I have done a netstat -ano and found the PID's that are using these ports, ...
MrLane's user avatar
  • 247
10 votes
2 answers
23k views

lots of packets pruned and packets collapsed because of socket buffer low/overrun

i've set up a test machine (debian squeeze 2.6.32 on a linode 2048 machine) that interact with an api that returns large chunks of json. It calls the API 3000/minutes asynchronously, the api is ...
hellvinz's user avatar
  • 3,086
0 votes
1 answer
3k views

Is this normal? Multiple httpd process

I'm testing a new Server. This isnt really a peak time for my server (2pm), but still its running a bit slow, I was checking the ESTABLISHED connections using the following command: # netstat -ntu | ...
ilcreatore's user avatar
3 votes
2 answers
12k views

What does each field of netstat -ano mean?

tcp 0 0 219.155.32.195:8888 221.137.227.51:5943 TIME_WAIT timewait (58.45/0/0) tcp 0 0 219.155.32.195:8888 221.137.227.51:5936 TIME_WAIT timewait (59.36/0/0)...
kernel's user avatar
  • 8,671
1 vote
1 answer
4k views

High count packets rejects in established connections because of timestamp

I am trying to set up a Wowza media server using a Dell R710 with 24GB memory and a 10Gbit connection and all the calculations say it should be able to handle around 20k connections however when I get ...
Roger's user avatar
  • 11
2 votes
2 answers
2k views

Apache many httpd process by my own server IP? eating all my Ram

Well i just bought a new dedicated server, I have no Linux experience, but i'm trying to learn. I have been testing the server for a few days. I improve the httpd.conf my.cnf for better performance, ...
ilcreatore's user avatar
4 votes
2 answers
6k views

(node) Hit max file limit. Increase "ulimit -n"

In Ubuntu 9 I am receiving a message on my server that says: (node) Hit max file limit. Increase "ulimit -n" However, typing commands in the terminal reveals the following: $ ulimit ...
kidcapital's user avatar
0 votes
2 answers
2k views

How to speed up a server using netstat & httpd.conf?

I'm using netstat commands to help optimize my httpd.conf correctly. Here are the results: netstat -an | grep -c :80 579 netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -...
Moe's user avatar
  • 13
0 votes
1 answer
2k views

How to monitor real time sendq and recvq sizes

netstat -an will give the recvq and sendq on a particular connection. When I have an application (in this case a dumb echo server) listening on a port and I put the load on and run netstat in a loop, ...
kakinada's user avatar
2 votes
3 answers
1k views

netstat issue: cannot pipe output from 'netstat -c' to an nfs mount

Short version: Netstat works fine except when I redirect output to a file in NFS. doesn't work: netstat -c > /nfs/mount/file works: netstat > /nfs/mount/file works: netstat -c works: ...
Buck's user avatar
  • 33
3 votes
0 answers
1k views

Netstat Send-Q High

Am using Ubuntu Server 10.10 and when i do netstat -tuna i get the many connections with Send-Q very high, 23K, 50K, 100K. This users report that they have latency problems when connecting to the ...
Luis Alvarado's user avatar
48 votes
7 answers
84k views

How to find other end of unix socket connection?

I have a process (dbus-daemon) which has many open connection over UNIX sockets. One of these connections is fd #36: =$ ps uw -p 23284 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME ...
user avatar
0 votes
2 answers
2k views

Why can't I access my Linux FTP (vsftpd) server?

I've just installed vsftpd, and started the service. The service is running, and my netstat dump shows it (See below). I've also enabled anonymous access for good measure. However, when I try to ...
Yarin's user avatar
  • 1,366
0 votes
1 answer
3k views

Port 8080 not visible while doing netstat?

While trying to run Tomcat on my Windows 2003 OS, I am noticing that the server is not running but at the same time it is not throwing any exceptions on the console. My first hunch was that the server ...
sc_ray's user avatar
  • 107
2 votes
2 answers
941 views

Linux: How to display all sockets opened for a particular interface?

How can I display all sockets opened for a particular interface?
user avatar
1 vote
2 answers
4k views

Can't connect to local server

I'm migrating a client / server application from Linux to Windows and while the Linux version of the server works fine, the Windows version won't connect via localhost. While the program is trying to ...
Mike's user avatar
  • 113
3 votes
1 answer
24k views

Lots of TIME_WAIT connections in netstat (Windows Server 2008)

I'm having some issues on a Windows 2008 server with some network connections not going through. For instance, in a web application on the server, we need to open a socket connection to another server,...
Rhys Causey's user avatar
1 vote
1 answer
1k views

netstat on fresh install of Solaris 10 update 9

I am attempting to decipher the below output bash-3.00$ netstat -a UDP: IPv4 Local Address Remote Address State -------------------- -------------------- ---------- *.sunrpc ...
700 Software's user avatar
  • 2,273
1 vote
2 answers
5k views

netstat reports PID that doesn't exist - wtf and how do I close it?

I have an app that listens on port 7001, which sometimes crashes but leaves the port open. netstat reports a PID that doesn't exist. How is that possible? How can I force the port to close without ...
Joe Daley's user avatar
  • 161
0 votes
1 answer
1k views

In "The Social Network", what linux program is Mark using to monitor traffic in near real-time? [duplicate]

Possible Duplicate: How to watch logs in real time via Terminal? The scene where Mark is monitoring TCP/IP connections to his Facemesh website, and comments "look at all this traffic". What ...
user avatar
53 votes
4 answers
214k views

How do I make cURL use keepalive from the command line?

I'm trying to verify that HTTP persistent connections are being used during communication with a Tomcat webserver I've got running. Currently, I can retrieve a resource on my server from a browser (e....
Rob Hruska's user avatar
1 vote
1 answer
4k views

Unknown connections to foreign hosts

When I run netstat -a, a lot of connections to foreign hosts show up. It's connected to a whole subnet, ie 123.123.123.x to the port 80. How can I see what is actually going on? My server doesn't look ...
Ledio Berdellima's user avatar
0 votes
1 answer
286 views

Netstat - Thunderbird and others work on strange ports

I'm getting this: $ sudo netstat -alpv tcp 0 0 comp.local:35409 ey-in-f16.1e100.n:imaps ESTABLISHED 2782/thunderbird-bi tcp 0 0 comp.local:52950 ew-in-f16....
Tomasz Zieliński's user avatar
9 votes
4 answers
43k views

Showing date/time in netstat

Is it possible to have netstat show the date/time the connection was established? Is this information even stored anywhere in Linux?
steelcityamir's user avatar
0 votes
3 answers
4k views

Windows server 2008 & SQL - many connections in TIME_WAIT

When I run netstat, I get this: TCP xxxx:65524 65.55.11.162:80 TIME_WAIT 0 There are 13941 of such lines in netstat at this point. Server is running Windows 2008 & SQL Server ...
bh213's user avatar
  • 103
0 votes
3 answers
2k views

Port listed as close-combat in netstat

Have just run netstat -A on my SQL Server and seen an established connection from one of our workstations on bmcw000340.domain:close-combat. My google-fu is failing me and I can't find out what close-...
Paul D'Ambra's user avatar
  • 1,082
3 votes
1 answer
13k views

TIME_WAIT in netstat of Apache processes

What are the meaning of the TIME_WAIT when using netstat of my web server process? I am sure the web server is not over loaded. tcp 0 0 0.0.0.0:80 0.0.0.0:* ...
Howard's user avatar
  • 2,175
12 votes
3 answers
16k views

In the output for netstat what does the [::] mean?

In the results for netstat what does the [::] mean? example [::]:ssh [::]:* LISTEN
Ric's user avatar
  • 171
4 votes
3 answers
326 views

Windows Server 2008/2003 - determine all "used" local network ports

I have been tasked with enabling the local firewall on 100+ servers. The systems are running many different applications using many different ports. I began with an nmap scan, but without going to ...
moniker's user avatar
  • 85
0 votes
2 answers
526 views

Netstat and strange activity

when i did some monitoring network activity of my server, using netstat -na, in a sec i noticed next, for me strange line: first it was: tcp 0 0 XXX.XXX.XXX.XXX:22 YYY.YYY.YYY.YYY:...
user48058's user avatar
  • 863
0 votes
3 answers
595 views

Is this hacking attempt?

on command netstat -na, between others, i'm getting next line: tcp 0 0 XXX.XXX.XXX.XXX:48746 YYY.YYY.YYY.YYY:80 TIME_WAIT is this some kind of hacking attempt? can you give ...
user48058's user avatar
  • 863
5 votes
1 answer
1k views

Why is rpc.lockd obscured from netstat/lsof output?

Prologue: On a number of machines, which happen to act as NFS clients, netstat reports two ports that are open with no PID listed for an associated daemon. Ordinarily this might be a bit concerning. ...
Dan Carley's user avatar
  • 25.8k
0 votes
1 answer
321 views

Finding Network Status of specific process name

I am looking for the cleanest way on linux to find the port status for a port being used by a specified program name via the command line. I have seen that netstat -p lists all pids but haven't seen ...
Moev4's user avatar
  • 103
1 vote
3 answers
8k views

debugging spiking netstat "failed connection attempts" with iptables

http://farm4.static.flickr.com/3305/4588110530_a60c934289_o.png This graph is munin collecting netstat -s output. I want to determine where the connections are coming from. There is nothing obvious ...
someara's user avatar
  • 21
1 vote
2 answers
380 views

What can I use to monitor which IP address w/name resolution is connected to each PID?

This would be for under Linux particularly. Is there a tool out there, or a script that I could use to monitor IP connections--with name resolution--and, see which process they're connected to? ...
supercheetah's user avatar

1
3 4 5
6
7