Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hi is there a way to display TCP handshake in Linux? Like for example this WIKI - TCP handshake Not exactly like the illustration but at least it would show client has sent SYN, ACK, FIN etc and the servers response as well.
Just take note I can't use wireshark, tcpdump or other packet capturing programs, just using internal Linux commands, processes or libraries.



I know this question is closed but I just want to update this coz I found out what I was looking for.

Using this command:


its found here: TCP Connections
I need to improve my googling skills :)

share|improve this question

closed as too localized by warl0ck, Gilles, vonbrand, Ulrich Dangel, jasonwryan Apr 8 '13 at 18:07

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

What is an "internal Linux command" for you? Why does tcpdump not count as such? - What do you need the handshake for? – michas Apr 8 '13 at 6:54
i would like to know if each connection from the server to each client was terminated properly. tcpdump and other programs doesn't count because I can't install them. Internal linux command is like bash commands because I only know a few. – dimas Apr 8 '13 at 7:15
You should use wireshark for this purpose – warl0ck Apr 8 '13 at 7:39
I agree that wireshark would be the proper tool for this. That said, you can get some information through netstat. And honestly, what are "bash commands"? Even such things as ls and mkdir are external executables. Have a look in /bin, and try type $somecommand. – Michael Kjörling Apr 8 '13 at 8:49
wireshark / tcpdump etc. are internal linux commands, your restriction doesn't make sense. you don't do packet capturing with your shell... – Ulrich Dangel Apr 8 '13 at 9:19

You can use netstat -na to show the current connections, including the state of that connection. E.g. for a connection that's still in the handshake process, it'll look like

tcp        0      1             SYN_SENT    
share|improve this answer
This does show the current socket state and IMO answers the question. Yet, from the comments to the question, this will not solve the actual problem "i would like to know if each connection from the server to each client was terminated properly". Because a kernel will eventually close a socket and not tell you if it was by timeout or a received and ACK-ed FIN. – Bananguin Apr 8 '13 at 10:30
True; I missed that in the comments. Which is a good example of why clarifications should be added to the question rather than hidden down in the comments... – Jenny D Apr 8 '13 at 10:32
thanks for answering Jenny, yeah I didn't have the chance to edit my question as it was already close. Also i used netstat, /proc and a combination of other commands but none of them really display what I want. – dimas Apr 8 '13 at 20:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.