Hot answers tagged netstat
13
Using lsof (as root):
# lsof -i -n -P
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 3028 root 3u IPv4 7072 0t0 TCP *:22 (LISTEN)
sshd 3028 root 4u IPv6 7074 0t0 TCP *:22 (LISTEN)
iproute2's ss can do this, too (as root):
# ss -lp
State Recv-Q Send-Q Local Address:Port ...
7
As recommended by IBM: use lsof -i -n and look for port XY. If you want parseable output from lsof, use the -F flag and parse the output with awk.
You can get pre-compiled binaries for AIX V5. I don't know if there are pre-compiled binaries for V6; if there aren't, get the source and compile it.
6
Use the bash [[ conditional construct and prefer the $(<command>) command substitution convention. Additionally, [[ prevents word splitting of variable values therefore there is no need to quote the command substitution bit..
if [[ $(netstat -lnp | grep ':8080') == *java* ]]; then
echo "Found a Tomcat!"
fi
6
One way is to say lsof -i:57010 -sTCP:ESTABLISHED. This walks the kernel's open file handle table looking for processes with an established TCP connection using that port. (Network sockets are file handles on *ix type systems.) You'd use -sTCP:LISTEN on the server side to filter out only the listener socket instead.
Because of the way lsof works, it can ...
5
How (where) can I find out information about them,
First you have to find out which program is bound to each port. Unfortunately, there is no single standard way to do that which will work on all *ix type systems, and your question doesn't specify one.
Some versions of netstat have a flag which will include the associated program name on each output ...
5
Another alternative is to simply test the exit status of grep itself, which will return false (1) if there was no match and true (0) if there was one, by not using the [ command.
if netstat -lntp | grep ':8080.*java' > /dev/null; then
echo "Found a Tomcat!"
fi
The redirection to /dev/null is to prevent it from also printing the found line to the ...
3
Yes you can. Download it.
But as you don't say what flavor of linux re you using here is couple of examples:
Debian/Ubuntu related:
# What package is the netstat executable in?
apt-file search /usr/bin/netstat
# Now download the source of that package
apt-get source net-tools
CentOS/Red Hat:
yumdownloader --source net-tools
2
Try using netstat with rmsock.
port=$1
addr=`netstat -Aan | grep $port | awk '{print $1}`
pid=`rmsock $addr tcpcb | awk '{print $9}'`
ps -ef | grep $pid
For netstat, the -A shows the address of any protocol control blocks associated with the sockets, the -a option shows the state of all sockets including those of server processes, and the -n option gives ...
2
This one is per interface and I am looking per socket.
Then use just netstat i.e.
uname -r
5.10
type netstat
netstat is hashed (/usr/bin/netstat)
netstat
TCP: IPv4
Local Address Remote Address Swind Send-Q Rwind Recv-Q State
-------------------- -------------------- ----- ------ ----- ------ -----------
localhost.53206 ...
2
# netstat -i
Name Mtu Net/Dest Address Ipkts Ierrs Opkts Oerrs Collis Queue
lo0 8232 loopback localhost 52559 0 52559 0 0 0
hme0 1500 sys11 sys11 18973 0 30292 0 0 0
This has a Queue column with In/Out packets. Does this meet you needs?
Note: Ran on solaris 10
2
The command
netstat -a | grep LISTEN
lists all the processes listening on various types of sockets. These sockets can be of any address families like ipv4 (udp or tcp), ipv6 (udp6 or tcp6), unix.
The entries like:
tcp 0 0 *:webmin *:* LISTEN
tcp 0 0 *:ftp *:* ...
2
The script in your answer has a race condition, the only way to avoid it is to atomically check if it is open by trying to open it. If the port is in use, the program should quit with a failure to open the port.
For example, say you're trying to listen with netcat.
#!/bin/bash
read lowerPort upperPort < /proc/sys/net/ipv4/ip_local_port_range
while :; do
...
2
Two ways:
lsof -i :port -S
netstat -a | grep port
You can do man lsof or man netstat for the needed info.
Replace port by the port number you want to search for.
1
UDP is a connectionless protocol. SS probably won't show one in LISTEN state, only in UCONN or ESTAB.
If I do this,
$ nc -u -l 2333
Then ss will show (in a 2nd shell):
$ ss -au|grep 2333
UNCONN 0 0 *:2333 *:*
If I then connect to it (3rd shell)
$ nc -u localhost 2333
then SS shows:
$ ss ...
1
for what its worth... depending on the version of netstat (specifically GNU netstat) you have, you can use
netstat -punta | grep <port>
this will show you connections in ESTABLISHED and LISTEN states UDP and TCP and it will ignore the UNIX local sockets. the end result is a nice, neat, small result set.
the -p flag will give you the process ID ...
1
On Linux, you could do something like:
ss -tln |
awk 'NR > 1{gsub(/.*:/,"",$4); print $4}' |
sort -un |
awk -v n=1080 '$0 < n {next}; $0 == n {n++; next}; {exit}; END {print n}'
To find the first free port above 1080. Note that ss -D would bind on the loopback interface, so in theory you could reuse port 1080 if a socket has it bound on ...
1
As far as i know, you can't (except on BSD systems, where Finkregh's solution works fine). It might be possible but you don't care, because most application listen on every interface, even when bound to an IP address.
On linux (and openwrt), the only way for an application to listen only on a certain interface is the SO_BINDTODEVICE socket option. Few ...
1
You can do more precise, yet simple, matching with awk.
if netstat -lnp | awk '$4 ~ /:8080$/ && $7 ~ /java/ {exit(0)} END {exit(1)}'; then …
To match the structure of your command more closely, the portable way of doing wildcard matching on a string in a shell is with the case construct.
case "$(netstat -lnp | grep ':8080')" in
*java*) echo ...
1
Add this sed command at the end of your pipe. It does a greeding search until last . and delete it and all digits that follow it.
... | sed -e 's/^\(.*\)\.[0-9]*/\1/'
It yields:
tcp4 0 0 61.129.65.176.80 123.120.207.172 ESTABLISHED
tcp4 491 0 61.129.65.176.80 171.250.180.211 ESTABLISHED
tcp4 286 0 ...
1
netstat -nap | grep LISTEN will give the below output, which will include the name and the pid of the listening processes:
unix 2 [ ACC ] STREAM LISTENING 20763 2333/gnome-terminal /tmp/orbit-eugene/linc-91d-0-2dbe139bd35e3
unix 2 [ ACC ] STREAM LISTENING 17900 2014/bonobo-activat ...
1
Set proper field separator, then use awk built-in regex matching to get rid of greps.
Here is the version with piping output to uniq. IMO, there is no real need for completely replacing uniq with some awk code, because it gets less simple and less unix-y.
netstat -nt | gawk --re-interval -F':|[ ]+' '$7==5222 && $8=="ESTABLISHED" && $6 ~ ...
1
On Linux, you can set up the audit subsystem to log every attempt to establish a network connection. For information about the audit subsystem, read the auditctl man page or this tutorial or other examples on this site. Install your distribution's auditd package if necessary, then
auditctl -A exit,always -S connect
1
If you're able to install a custom kernel, you should have a look at SystemTap (http://sourceware.org/systemtap/). There are plenty of examples how to trace network activity.
1
You can use ip-conntrack to accomplish this. It's a connection tracking module used normally to monitor connections for oddly behaving protocols (like FTP) to be managed by a firewall/NAT box.
modprobe ip_conntrack
cat /proc/net/ip_conntrack
You can pipe the output through grep to see established connections and further grep the source IP to see when it ...
1
netstat is part of the net-tools suite. The project home page is here:
https://developer.berlios.de/projects/net-tools/
You can browse the netstat source here: http://cvs.berlios.de/cgi-bin/viewvc.cgi/net-tools/net-tools/netstat.c?view=markup or download the netstat.c file.
1
One of the quickest way to find the application locking port is to use lsof or lsof64:
lsof64 -nP | grep $PortNumber
or
lsof -nP | grep $PortNumber
Above will return process ID locking/using given port number. Once you have it then run below to find running application/process
proctree $pid
Only top voted, non community-wiki answers of a minimum length are eligible
