Hot answers tagged

21 votes
Accepted

HTTPD listening in IPv6, according netstat, but reacheable in IPv4

I believe that on Linux, binding to [::] (IPv6) results in receiving both IPv6 and IPv4 traffic (by default). I believe these are referred to as IPv4-mapped IPv6 addresses. netstat simply shows the ...
  • 9,261
20 votes
Accepted

How to catch DNS request using 'netstat' in Unix

Netstat almost certainly won't be able to help you. Netstat displays open sockets and active connections at the moment you execute the program. A DNS request will happen entirely too quickly for you ...
  • 1,317
19 votes

How to make netstat on Linux only show OUTBOUND tcp connections?

netstat -nputw should do the trick. Add c for continuous updating. Also, this may be more what you're looking for: https://askubuntu.com/questions/252179/how-to-inspect-outgoing-http-requests-of-a-...
  • 347
19 votes

How to catch DNS request using 'netstat' in Unix

I don't think netstat will let you inspect the actual traffic but tcpdump will if you don't have access to netcat. tcpdump udp port 53 should show you the traffic.
  • 400
18 votes

netstat shows a listening port with no pid but lsof does not

Based on hint from @user202173 and others I have been able to use the following to track down the process that owns a port even when it is listed as - in netstat. Here was my starting situation. sudo ...
  • 313
17 votes

How to find other end of unix socket connection?

Actually, ss from iproute2 (replacement for netstat, ifconfig, etc.) can show this information. Here is an example showing an ssh-agent unix domain socket to which a ssh process has connected: $ ...
  • 4,251
14 votes

linux : netstat listening queue length

Let's look into source code, as it's the best documentation in the world of open source. net/ipv4/tcp_diag.c: if (sk->sk_state == TCP_LISTEN) { r->idiag_rqueue = sk->sk_ack_backlog; ...
  • 416
13 votes

netstat -ntap doesn't show pid/process name for some connections?

198_141:~ # netstat -anp|grep 33000 tcp 0 0 0.0.0.0:53000 0.0.0.0:* LISTEN - 198_141:~ # lsof -i:33000 COMMAND PID USER FD TYPE ...
  • 231
11 votes

What's the difference between IP address 0.0.0.0 and 127.0.0.1?

In simple terms: Listening on 0.0.0.0 means listening from anywhere that has network access to this computer, for example, from this very computer, from local network or from the Internet, while ...
9 votes
Accepted

Does "ESTABLISHED" state in netstat command for the sshd program mean they actually have access?

Established only means that the connection is fully open and data can be transmitted. It doesn't necessarily mean that any data has been transmitted! It doesn't imply anything about layer 7, whether ...
9 votes
Accepted

Why does this "netstat -tln" output show entries for "0.0.0.0:22" and "127.0.0.1:3306"

0.0.0.0:22 The above means you are listening on port 22 (ssh) all ip addresses 127.0.0.1:3306 The above means you are listening on port 3306 (mysql) for local loopback only The reason the first two ...
  • 1,829
8 votes
Accepted

How to make netstat on Linux only show OUTBOUND tcp connections?

If you only want outbound tcp connections, I think you can use netstat -atn | tr -s ' '| cut -f5 -d ' ' | grep -v '127.0.0.1' That will show all connections whose destination is not your localhost. ...
  • 164
7 votes
Accepted

What causes “SYN to LISTEN sockets dropped”?

These counters ultimately come from the kernel and map to the LINUX_MIB_LISTENOVERFLOWS and LINUX_MIB_LISTENDROPS counters. You can see from the source of net/ipv4/tcp_ipv4.c(tcp_v4_syn_recv_sock) ...
  • 4,691
7 votes

Get number of TCP established connections

Use the command: ss -neopt state established This will show you only TCP sessions in ESTABLISHED state, no piping to other commands required, so it's super fast. ss is better than netstat because ...
  • 3,496
6 votes
Accepted

cURL can connect to localhost but browser cannot

Most Browsers restrict 10080 for security reasons on localhost Solution Change the Port. References Google Chrome blocks port 10080 to stop Nat slip streaming attacks Chrome Platform Additonal ...
  • 1,410
5 votes

there is empty ips in netstat

Your picking up ipv6 network connections which often have a number of colons in them. The cut command doesnt take this into account when snipping the colons out from the IP address. Might be more ...
  • 23.1k
4 votes

Huge amount of TIME_WAIT connections says netstat

tcp_fin_timeout does NOT control TIME_WAIT delay. You can see this by using ss or netstat with -o to see the countdown timers: cat /proc/sys/net/ipv4/tcp_fin_timeout 3 # See countdown timer for all ...
  • 5,560
4 votes
Accepted

Get number of TCP established connections

Using /proc to reduce workload I like to access kernel variables directly through /proc. This is very efficient, quick and system friendly. There is a pseudo file (kernel variables table) named /...
  • 156
4 votes

Limit to number of listening ports in linux

You are probably hitting at nofile limit, which is by default 1024. Try raising ulimit -n in your shell before running the program, like: $ ulimit -n 20480; ./myprogram Offcourse, you have to have ...
  • 5,247
4 votes
Accepted

Is postfix the only program that should be using port 25

Anything using port 25 should be a verified SMTP program that you both know about - and have authorized. In your case, that is ONLY postfix. You should know that having an open relay can also cause ...
  • 1,336
4 votes
Accepted

Why when i use netstat while not connected to internet, it returns some ip addresses?

On windows server OS's after WinNT 4.0 SP3, this information is coming up by design. The Winsock applications on your machine are listening (waiting for information) from those ports. 0.0.0.0 means '...
4 votes
Accepted

Heavy TCP traffic on loopback

The SYN/RST indicates that the port is closed so then the application closes the connection which means that it would be visible in netstat during only a fraction of a second. You can try to drop the ...
  • 133
4 votes

What application is connecting to a remote site?

Let us see... The IP address 165.254.162.243 is on AS14627, which is a company named Vitalwerks. WHOIS tells me that they have the entire /24. A brief look at Google tells me Vitalwerks is the ...
4 votes

Docker networking IPv6 exposed

This is not the nginx container that listens ipv6 (btw, the tcp6 socket you see in the container is bound on its fe80:: and ::1, and it is not reachable from outside the container world). This is the ...
  • 41
3 votes

Is there a netstat -s equivalent for windows?

No for built-in tool. Only way I can think of is to use the winpcap/npf library to build your own tool to make up stat that you need. In windows the network stack is stripped compared to the Linux/...
  • 16.5k
3 votes

Network port open, but no process attached?

I was able to track down the process by getting its inode via netstat and then using that inode with lsof. See my more detailed answer in https://serverfault.com/a/847910/94376.
  • 313
3 votes

Netstat continuous refresh (watch changes the output)

Monitoring on Ubuntu 18.04 LTS, this worked well. It displays good human-readable output. sudo netstat -tupnc
  • 131
3 votes

Netstat continuous refresh (watch changes the output)

Searching for command for macos ends up here. For those mac user who want to see the real-time connections of a process: nettop -p 60683 You can also restrict the interface type, like wifi or wired.....
  • 131
3 votes

Get number of TCP established connections

Check also: 527875. netstat + grep is a good and simple option for a few connections but if you have a huge number of connections I would recommend ss as recommended in nixCraft. For instance: ss -s ...
3 votes

Is it normal to have many connections from my own server ip when I ran netstat command?

As already stated by Tero Kilkanen in its comment: "...It completely depends on the applications you are running on your server...". Based on your very question, I assume that it's not easy, for you, ...

Only top scored, non community-wiki answers of a minimum length are eligible