0

I have a question about linux netstat usage and output results. I'm trying to solve a dilema about why my server is facing communications delays and bottle neck issues, So I started digging and studying and one of the things I needed to know is a full connections list grouped per ip address and count number of stablished connections, so I first got this:

[root@ip-localhost ec2-user]# netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

  ...
  9 77.70.115.30
 14 54.211.25.39
198 172.31.30.15

3951

The question, If I make the summatory of the listed quantity of connections per ip I'm not getting a total of 3951, that number also raise to over 44K so, what the final line number without ip address represents? file descriptors? possible internal kernel connections? opened sockets forgot for the system?

I have also a summary of the connetions :

[root@ip-localhost ec2-user]# netstat -ant | awk '{print $6}' | sort | uniq -c | sort -n
   1 established)
   1 Foreign
   4 FIN_WAIT1
   8 SYN_SENT
  57 LISTEN
  67 SYN_RECV
 180 TIME_WAIT
1040 LAST_ACK  
6323 CLOSE_WAIT  
7209 ESTABLISHED  

```

note: I had to insert the full output due to get to the point that listed connections aren't totalized at the end of the netstat output. thanks

  • Would you please add more detail? Server type, Apache?, a full paste of your raw netstat into pastebin, for instance? – Rui F Ribeiro Feb 9 '16 at 21:25
  • I did it, the output is a list of all ipaddresses and number of active connections, but the stackexchange "rules" for post something forced me to remove huge part of the output, but, let me be more specific : the out put was this: first 80 lines of ipaddreses with only 1 connection stablished then follow like this: ``` 5 192.168.0.1 5 192.168.0.2 150 xxx.xx.xx.xx 3951 ``` The last number seems to be a sum of all listed devices but when I did the maths the list showed up 150 connections not 3951, after 40 minutes that number was raised to 44000 and the list sumatory was 1200 – Luis Parada Feb 10 '16 at 2:02
  • so the last number 3951 without ip address what represents?? please type the command I originally posted and check your linux output and tell me what is the last number of your output, the higher number without ipaddress – Luis Parada Feb 10 '16 at 2:08
4

Well I think you should first understand the command netstat before applying awk and cut in the output.

netstat -ntu 

will display all the udp and tcp connections including tcp6. So when you are trying to apply awk & cut on the output of netstat command

netstat -ntu | awk '{print $5}' | cut -d: -f1

the cut command then chose ":" as the delimiter and display the first field.

A tcp v4 connection looks like this

12.34.56.78:80

A tcp v6 connection looks like this in netstat output

::1:631

now when you apply cut with delimiter ":" the output of tcp v4 connection will show you the ip address, but output of tcp v6 will be a blank line. And applying sort|uniq -c will count the blank lines.

If you want to list out all tcp established connections to your web server, try this

netstat -npa | grep pid_of_your_web_server | grep ESTABLISHED  | awk '{print $5}' | awk -F ':' '{print $1}' | sort | uniq -c 

Or all tcp connections related to your web server

netstat -npa | grep pid_of_your_web_server | grep tcp | grep -v LISTEN | awk '{print $5}' | awk -F ':' '{print $1}' | sort | uniq -c

to take a total count of all , without grouping

netstat -npa | grep pid_of_your_web_server | grep tcp | grep -v LISTEN | wc -l
0

sorry to jump old subject but it is never too late for improvements, Why not use one awk for everything and not waste resources on grep like so:

netstat -npa | awk -F: '/tcp/&&/LISTEN/ {print $1}' | sort | uniq -c

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.