Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
20 votes
Accepted

How to catch DNS request using 'netstat' in Unix

Netstat almost certainly won't be able to help you. Netstat displays open sockets and active connections at the moment you execute the program. A DNS request will happen entirely too quickly for you ...
Shadur-don't-feed-the-AI's user avatar
19 votes

netstat shows a listening port with no pid but lsof does not

Based on hint from @user202173 and others I have been able to use the following to track down the process that owns a port even when it is listed as - in netstat. Here was my starting situation. sudo ...
studgeek's user avatar
  • 323
19 votes

How to catch DNS request using 'netstat' in Unix

I don't think netstat will let you inspect the actual traffic but tcpdump will if you don't have access to netcat. tcpdump udp port 53 should show you the traffic.
sidprak's user avatar
  • 400
17 votes

linux : netstat listening queue length

Let's look into source code, as it's the best documentation in the world of open source. net/ipv4/tcp_diag.c: if (sk->sk_state == TCP_LISTEN) { r->idiag_rqueue = sk->sk_ack_backlog; ...
Alexander's user avatar
  • 456
17 votes

How to find other end of unix socket connection?

Actually, ss from iproute2 (replacement for netstat, ifconfig, etc.) can show this information. Here is an example showing an ssh-agent unix domain socket to which a ssh process has connected: $ ...
Zulakis's user avatar
  • 4,263
13 votes

netstat -ntap doesn't show pid/process name for some connections?

198_141:~ # netstat -anp|grep 33000 tcp 0 0 0.0.0.0:53000 0.0.0.0:* LISTEN - 198_141:~ # lsof -i:33000 COMMAND PID USER FD TYPE ...
Yans Ruan's user avatar
  • 231
11 votes

What's the difference between IP address 0.0.0.0 and 127.0.0.1?

In simple terms: Listening on 0.0.0.0 means listening from anywhere that has network access to this computer, for example, from this very computer, from local network or from the Internet, while ...
Hải Phong's user avatar
8 votes
Accepted

cURL can connect to localhost but browser cannot

Most Browsers restrict 10080 for security reasons on localhost Solution Change the Port. References Google Chrome blocks port 10080 to stop Nat slip streaming attacks Chrome Platform Additonal ...
djdomi's user avatar
  • 2,050
5 votes

Netstat continuous refresh (watch changes the output)

Searching for command for macos ends up here. For those mac user who want to see the real-time connections of a process: nettop -p 60683 You can also restrict the interface type, like wifi or wired.....
Iceberg's user avatar
  • 151
5 votes

Docker networking IPv6 exposed

This is not the nginx container that listens ipv6 (btw, the tcp6 socket you see in the container is bound on its fe80:: and ::1, and it is not reachable from outside the container world). This is the ...
atoy's user avatar
  • 51
5 votes
Accepted

Netstat and ss doesn't see connection

After couple of weeks I found answer. I needed to run netstat -tapn in all namespaces with following command: sudo ip -all netns exec netstat -tapn | grep 34226 Now I have PID number of process ...
QkiZ's user avatar
  • 692
4 votes

Huge amount of TIME_WAIT connections says netstat

tcp_fin_timeout does NOT control TIME_WAIT delay. You can see this by using ss or netstat with -o to see the countdown timers: cat /proc/sys/net/ipv4/tcp_fin_timeout 3 # See countdown timer for all ...
Greg Bray's user avatar
  • 5,680
4 votes
Accepted

Heavy TCP traffic on loopback

The SYN/RST indicates that the port is closed so then the application closes the connection which means that it would be visible in netstat during only a fraction of a second. You can try to drop the ...
spongebob's user avatar
  • 133
4 votes

What application is connecting to a remote site?

Let us see... The IP address 165.254.162.243 is on AS14627, which is a company named Vitalwerks. WHOIS tells me that they have the entire /24. A brief look at Google tells me Vitalwerks is the ...
Michael Hampton's user avatar
3 votes

What causes “SYN to LISTEN sockets dropped”?

Usually wmem and rmem defaults are 212992 bytes. Apparently not enough on busy server. Raised to 8MB and the problem disappeared. sysctl -w net.core.wmem_default=8388608 sysctl -w net.core....
Arie Skliarouk's user avatar
3 votes

Network port open, but no process attached?

I was able to track down the process by getting its inode via netstat and then using that inode with lsof. See my more detailed answer in https://serverfault.com/a/847910/94376.
studgeek's user avatar
  • 323
3 votes

Netstat continuous refresh (watch changes the output)

Monitoring on Ubuntu 18.04 LTS, this worked well. It displays good human-readable output. sudo netstat -tupnc
rjkunde's user avatar
  • 131
3 votes
Accepted

Check number of connections to webserver port 80 AND 443

Try netstat -ant | egrep '(:80|:443) .*:.*ESTABLISHED' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c or netstat -nt | awk '$4 ~ /:(143|993)$/ && $6 ~ /ESTABLISHED/ {print $5}' | cut -d:...
BillThor's user avatar
  • 28k
3 votes
Accepted

No webserver running, but replying to packets on ports 80 and 443

tcpdump port 80 and tcpdump port 443 should let you see what is happening, you might need to change the default interface using -i eth1 syntax in case it is happening on a different interface to the ...
bao7uo's user avatar
  • 1,714
3 votes
Accepted

How to deal with TCP connections attack on Linux

One thing you could try to limit the impact of the connections on apache is limiting them. There are a few ways of doing this, but one way could be: iptables -A INPUT -p tcp --dport 80 -i eth0 -m ...
iwaseatenbyagrue's user avatar
3 votes
Accepted

Check Used Ports on Linux without Command

You can get this information in /proc/net/tcp , /proc/net/udp or /proc/net/raw. More details and syntax here: http://www.onlamp.com/pub/a/linux/2000/11/16/LinuxAdmin.html Depending of what you want ...
Jérome Boham's user avatar
3 votes

Man in The Middle Attack, or something else?

Probably there's no-one trying to connect from 443 to a local upper port. Connections usually originates from dynamic port range (49152 through 65535). Is the 32884 always 32884 or is it actually ...
Esa Jokinen's user avatar
  • 50.1k
3 votes
Accepted

Man in The Middle Attack, or something else?

A normal hit to 192.0.73.2 redirects to https://en.gravatar.com/. This is definitely not MITM attack. Your website is using a module of gravatar and it is trying to connect to its server to gather ...
Dextro67's user avatar
  • 343
3 votes
Accepted

why are there are so many svchost established connections to Isilon?

You can tell that it's RPC traffic because of the connections to the RPC endpoint mapper on TCP port 135 and subsequent connections to a high-numbered port, e.g. 48471. You can use portqry and query ...
Ryan Ries's user avatar
  • 55.9k
3 votes

How to catch DNS request using 'netstat' in Unix

I saw tcpdump mentioned elsewhere here and while it is very suitable for the task some people might prefer to use a graphical application such as Wireshark!
Richard Jansson's user avatar
3 votes

Dovecot claims ports are in use, netstat disagrees

dovecot would appear to not be aware of (compatible with) portreserve. Check /etc/portreserve for configuration files that are reserving ports you need and remove them from scope (e.g. rename them ...
Doug's user avatar
  • 982
3 votes

How to find a malicious TCP program using netstat

netstat -tlape running this will show all (-a) processes (-p) currently listening (-l) on a TCP port (-t) with extended information (-e) note(s): you need to run this via sudo to see everything on ...
walder's user avatar
  • 51
3 votes

Show TCP keepalive status in Windows?

No, you'd need a third party software like Wireshark to view this. What you can view with Resource Monitor (resmon) is if a connection is on keepalive (the connection is greyed out) but you wont see ...
Manu's user avatar
  • 864
3 votes

Early warning of port exhaustion in Linux

you could write a bpf software using bpftrace to watch all connections opening and closing and maintain counters for each client,server,server port combination. That seems to be overly complex for ...
toppk's user avatar
  • 196
2 votes

linux : netstat listening queue length

There is no simple way to see that on Linux as far as I know. Recv-Q and Send-Q are not listen queue. They are the count of bytes not copied by the user program connected to the socket and not ...
Pavel Timofeev's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible