Tag Info

Hot answers tagged

14

Using lsof (as root): # lsof -i -n -P COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 3028 root 3u IPv4 7072 0t0 TCP *:22 (LISTEN) sshd 3028 root 4u IPv6 7074 0t0 TCP *:22 (LISTEN) iproute2's ss can do this, too (as root): # ss -lp State Recv-Q Send-Q Local Address:Port ...


9

(you might have to install the package ip on openwrt (v12 / attitude adjustment) ifconfig/netstat etc. are considered deprecated, so you should use (as root) ss -nlput | grep sshd to show the TCP/UDP sockets on which a running program which contains the string sshd is listening to -nno port to name resolution -lonly listening sockets -pshow processes ...


8

As recommended by IBM: use lsof -i -n and look for port XY. If you want parseable output from lsof, use the -F flag and parse the output with awk. You can get pre-compiled binaries for AIX V5. I don't know if there are pre-compiled binaries for V6; if there aren't, get the source and compile it.


8

One way is to say lsof -i:57010 -sTCP:ESTABLISHED. This walks the kernel's open file handle table looking for processes with an established TCP connection using that port. (Network sockets are file handles on *ix type systems.) You'd use -sTCP:LISTEN on the server side to filter out only the listener socket instead. Because of the way lsof works, it can ...


8

You can use netstat -anp | grep 57010 on server C. But this will only work if there isn't any firewall in between which is mapping port 57010 to a different one.


8

You can use netstat's -p option. You're already issuing it, but to get process information, you need to be the superuser: $ sudo netstat -nlp | grep 80 tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 125004/nginx


7

strace -e trace=connect -f yourprogram or using a dump file strace -o yourprogram.strace -e trace=connect -f yourprogram


6

Use the bash [[ conditional construct and prefer the $(<command>) command substitution convention. Additionally, [[ prevents word splitting of variable values therefore there is no need to quote the command substitution bit.. if [[ $(netstat -lnp | grep ':8080') == *java* ]]; then echo "Found a Tomcat!" fi


5

How (where) can I find out information about them, First you have to find out which program is bound to each port. Unfortunately, there is no single standard way to do that which will work on all *ix type systems, and your question doesn't specify one. Some versions of netstat have a flag which will include the associated program name on each output ...


5

Yes you can. Download it. But as you don't say what flavor of linux re you using here is couple of examples: Debian/Ubuntu related: # What package is the netstat executable in? apt-file search /usr/bin/netstat # Now download the source of that package apt-get source net-tools CentOS/Red Hat: yumdownloader --source net-tools


5

Another alternative is to simply test the exit status of grep itself, which will return false (1) if there was no match and true (0) if there was one, by not using the [ command. if netstat -lntp | grep ':8080.*java' > /dev/null; then echo "Found a Tomcat!" fi The redirection to /dev/null is to prevent it from also printing the found line to the ...


5

You can use fuser or lsof i.e: fuser 8453/tcp lsof -i TCP:8453 If you want more information from fuser you can also use the -v flag, i.e: fuser -v 8453/tcp


4

Just for the sake of completeness: Using ss from the new Linux networking utility tool-set (iproute2): ss -tp sport = :57010 dst 192.168.1.220


4

The man pages are your friends for info such as this: $ man netstat ... SYNOPSIS netstat [address_family_options] [--tcp|-t] [--udp|-u] ... Notice in the usage that those switches are the short forms of the GNU style switches --tcp and --udp.


4

By default sshd uses ipv4 and ipv6. You can configure the protocol sshd uses through the AddressFamily directive in /etc/ssh/sshd_config For ipv4 & ipv6 (default) AddressFamily any For ipv4 only AddressFamily inet For ipv6 only AddressFamily inet6 After you make any changes to sshd_config restart sshd for the changes to take effect.


3

The script in your answer has a race condition, the only way to avoid it is to atomically check if it is open by trying to open it. If the port is in use, the program should quit with a failure to open the port. For example, say you're trying to listen with netcat. #!/bin/bash read lowerPort upperPort < /proc/sys/net/ipv4/ip_local_port_range while :; do ...


3

Try using netstat with rmsock. port=$1 addr=`netstat -Aan | grep $port | awk '{print $1}` pid=`rmsock $addr tcpcb | awk '{print $9}'` ps -ef | grep $pid For netstat, the -A shows the address of any protocol control blocks associated with the sockets, the -a option shows the state of all sockets including those of server processes, and the -n option gives ...


3

Two ways: lsof -i :port -S netstat -a | grep port You can do man lsof or man netstat for the needed info. Replace port by the port number you want to search for.


3

for what its worth... depending on the version of netstat (specifically GNU netstat) you have, you can use netstat -punta | grep <port> this will show you connections in ESTABLISHED and LISTEN states UDP and TCP and it will ignore the UNIX local sockets. the end result is a nice, neat, small result set. the -p flag will give you the process ID ...


3

Also you can use lsof utility. Need to be root. # lsof -i :25 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME exim4 2799 Debian-exim 3u IPv4 6645 0t0 TCP localhost:smtp (LISTEN) exim4 2799 Debian-exim 4u IPv6 6646 0t0 TCP localhost:smtp (LISTEN)


3

Your mistake is that you're associating the information on the netstat output with the interface rather than the destination. Destination addresses can have associated gateways. When you configure your network, you're associating interfaces and gateways with sets of destination addresses -- so the question you need to be asking is "what's the gateway for ...


3

The part after the colon is the port number, and it's not always displayed as a number since there's a list of well-known ports uses in /etc/services, so you don't have to remember if 22 is ssh or telnet. (The reverse works as well – you can say telnet localhost http and it will understand http as meaning "port 80".) The netstat option --numeric-ports will ...


3

0.0.0.0 means the process is bound to all interfaces. 127.0.0.1 means the process is bound only to the 127.0.0.1 interface (loopback). If you had other interfaces you might have x.y.z.a entries indicating the process was bound to those specific interfaces. A process will only be told if traffic arrives on the interfaces to which it is bound, so yes, it's ...


2

This one is per interface and I am looking per socket. Then use just netstat i.e. uname -r 5.10 type netstat netstat is hashed (/usr/bin/netstat) netstat TCP: IPv4 Local Address Remote Address Swind Send-Q Rwind Recv-Q State -------------------- -------------------- ----- ------ ----- ------ ----------- localhost.53206 ...


2

# netstat -i Name Mtu Net/Dest Address Ipkts Ierrs Opkts Oerrs Collis Queue lo0 8232 loopback localhost 52559 0 52559 0 0 0 hme0 1500 sys11 sys11 18973 0 30292 0 0 0 This has a Queue column with In/Out packets. Does this meet you needs? Note: Ran on solaris 10


2

On Linux, you can set up the audit subsystem to log every attempt to establish a network connection. For information about the audit subsystem, read the auditctl man page or this tutorial or other examples on this site. Install your distribution's auditd package if necessary, then auditctl -A exit,always -S connect


2

If you're able to install a custom kernel, you should have a look at SystemTap. There are plenty of examples how to trace network activity.


2

If you are on Linux and can handle having ss installed: ss -o state established '( dport = :5222 )'|awk -F"[\t :]+" 'NR!=1{ ip[$5]+=1 } END{ for (i in ip){n++};print n }' If you would like the awk explained just let me know.


2

Probably, you need to add appropriate route table entries to reach local intranet server via 10.131.60.1, not via ppp0. Consult with your system administrator if you don't know exactly which addresses should be accessed via local gateway.


2

netstat is part of the net-tools suite. The project home page is here: https://developer.berlios.de/projects/net-tools/ You can browse the netstat source here: http://cvs.berlios.de/cgi-bin/viewvc.cgi/net-tools/net-tools/netstat.c?view=markup or download the netstat.c file.



Only top voted, non community-wiki answers of a minimum length are eligible