21
votes
Accepted
HTTPD listening in IPv6, according netstat, but reacheable in IPv4
I believe that on Linux, binding to [::] (IPv6) results in receiving both IPv6 and IPv4 traffic (by default). I believe these are referred to as IPv4-mapped IPv6 addresses. netstat simply shows the ...
- 9,261
20
votes
Accepted
How to catch DNS request using 'netstat' in Unix
Netstat almost certainly won't be able to help you.
Netstat displays open sockets and active connections at the moment you execute the program. A DNS request will happen entirely too quickly for you ...
- 1,317
19
votes
How to make netstat on Linux only show OUTBOUND tcp connections?
netstat -nputw should do the trick. Add c for continuous updating.
Also, this may be more what you're looking for:
https://askubuntu.com/questions/252179/how-to-inspect-outgoing-http-requests-of-a-...
- 347
19
votes
How to catch DNS request using 'netstat' in Unix
I don't think netstat will let you inspect the actual traffic but tcpdump will if you don't have access to netcat. tcpdump udp port 53 should show you the traffic.
- 400
18
votes
netstat shows a listening port with no pid but lsof does not
Based on hint from @user202173 and others I have been able to use the following to track down the process that owns a port even when it is listed as - in netstat.
Here was my starting situation. sudo ...
- 313
17
votes
How to find other end of unix socket connection?
Actually, ss from iproute2 (replacement for netstat, ifconfig, etc.) can show this information.
Here is an example showing an ssh-agent unix domain socket to which a ssh process has connected:
$ ...
- 4,251
14
votes
linux : netstat listening queue length
Let's look into source code, as it's the best documentation in the world of open source.
net/ipv4/tcp_diag.c:
if (sk->sk_state == TCP_LISTEN) {
r->idiag_rqueue = sk->sk_ack_backlog;
...
- 416
13
votes
netstat -ntap doesn't show pid/process name for some connections?
198_141:~ # netstat -anp|grep 33000
tcp 0 0 0.0.0.0:53000 0.0.0.0:* LISTEN -
198_141:~ # lsof -i:33000
COMMAND PID USER FD TYPE ...
- 231
11
votes
What's the difference between IP address 0.0.0.0 and 127.0.0.1?
In simple terms: Listening on 0.0.0.0 means listening from anywhere that has network access to this computer, for example, from this very computer, from local network or from the Internet, while ...
- 211
9
votes
Accepted
Does "ESTABLISHED" state in netstat command for the sshd program mean they actually have access?
Established only means that the connection is fully open and data can be transmitted. It doesn't necessarily mean that any data has been transmitted! It doesn't imply anything about layer 7, whether ...
- 240k
9
votes
Accepted
Why does this "netstat -tln" output show entries for "0.0.0.0:22" and "127.0.0.1:3306"
0.0.0.0:22
The above means you are listening on port 22 (ssh) all ip addresses
127.0.0.1:3306
The above means you are listening on port 3306 (mysql) for local loopback only
The reason the first two ...
- 1,829
8
votes
Accepted
How to make netstat on Linux only show OUTBOUND tcp connections?
If you only want outbound tcp connections, I think you can use
netstat -atn | tr -s ' '| cut -f5 -d ' ' | grep -v '127.0.0.1'
That will show all connections whose destination is not your localhost. ...
- 164
7
votes
Accepted
What causes “SYN to LISTEN sockets dropped”?
These counters ultimately come from the kernel and map to the LINUX_MIB_LISTENOVERFLOWS and LINUX_MIB_LISTENDROPS counters. You can see from the source of net/ipv4/tcp_ipv4.c(tcp_v4_syn_recv_sock) ...
- 4,691
7
votes
Get number of TCP established connections
Use the command:
ss -neopt state established
This will show you only TCP sessions in ESTABLISHED state, no piping to other commands required, so it's super fast.
ss is better than netstat because ...
- 3,496
6
votes
Accepted
cURL can connect to localhost but browser cannot
Most Browsers restrict 10080 for security reasons on localhost
Solution
Change the Port.
References
Google Chrome blocks port 10080 to stop Nat slip streaming attacks
Chrome Platform
Additonal ...
- 1,410
5
votes
there is empty ips in netstat
Your picking up ipv6 network connections which often have a number of colons in them. The cut command doesnt take this into account when snipping the colons out from the IP address.
Might be more ...
- 23.1k
4
votes
Huge amount of TIME_WAIT connections says netstat
tcp_fin_timeout does NOT control TIME_WAIT delay. You can see this by using ss or netstat with -o to see the countdown timers:
cat /proc/sys/net/ipv4/tcp_fin_timeout
3
# See countdown timer for all ...
- 5,560
4
votes
Accepted
Get number of TCP established connections
Using /proc to reduce workload
I like to access kernel variables directly through /proc. This is very efficient, quick and system friendly.
There is a pseudo file (kernel variables table) named /...
- 156
4
votes
Limit to number of listening ports in linux
You are probably hitting at nofile limit, which is by default 1024.
Try raising ulimit -n in your shell before running the program, like:
$ ulimit -n 20480; ./myprogram
Offcourse, you have to have ...
- 5,247
4
votes
Accepted
Is postfix the only program that should be using port 25
Anything using port 25 should be a verified SMTP program that you both know about - and have authorized. In your case, that is ONLY postfix. You should know that having an open relay can also cause ...
- 1,336
4
votes
Accepted
Why when i use netstat while not connected to internet, it returns some ip addresses?
On windows server OS's after WinNT 4.0 SP3, this information is coming up by design.
The Winsock applications on your machine are listening (waiting for information) from those ports.
0.0.0.0 means '...
- 56
4
votes
Accepted
Heavy TCP traffic on loopback
The SYN/RST indicates that the port is closed so then the application closes the connection which means that it would be visible in netstat during only a fraction of a second.
You can try to drop the ...
- 133
4
votes
What application is connecting to a remote site?
Let us see...
The IP address 165.254.162.243 is on AS14627, which is a company named Vitalwerks. WHOIS tells me that they have the entire /24.
A brief look at Google tells me Vitalwerks is the ...
- 240k
4
votes
Docker networking IPv6 exposed
This is not the nginx container that listens ipv6 (btw, the tcp6 socket you see in the container is bound on its fe80:: and ::1, and it is not reachable from outside the container world). This is the ...
- 41
3
votes
Is there a netstat -s equivalent for windows?
No for built-in tool. Only way I can think of is to use the winpcap/npf library to build your own tool to make up stat that you need.
In windows the network stack is stripped compared to the Linux/...
- 16.5k
3
votes
Network port open, but no process attached?
I was able to track down the process by getting its inode via netstat and then using that inode with lsof. See my more detailed answer in https://serverfault.com/a/847910/94376.
- 313
3
votes
Netstat continuous refresh (watch changes the output)
Monitoring on Ubuntu 18.04 LTS, this worked well. It displays good human-readable output.
sudo netstat -tupnc
- 131
3
votes
Netstat continuous refresh (watch changes the output)
Searching for command for macos ends up here. For those mac user who want to see the real-time connections of a process:
nettop -p 60683
You can also restrict the interface type, like wifi or wired.....
- 131
3
votes
Get number of TCP established connections
Check also: 527875.
netstat + grep is a good and simple option for a few connections but if you have a huge number of connections I would recommend ss as recommended in nixCraft.
For instance: ss -s
...
- 325
3
votes
Is it normal to have many connections from my own server ip when I ran netstat command?
As already stated by Tero Kilkanen in its comment: "...It completely depends on the applications you are running on your server...".
Based on your very question, I assume that it's not easy, for you, ...
- 3,988
Only top scored, non community-wiki answers of a minimum length are eligible