2

Apache tomcat is running on port 8080, but netstat -tlnp does not show it, instead its output gets truncated with a binary character:

# netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name   
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      1422/mysqld         
tcp        0      0 0.0.0.0:139             0.0.0.0:*               LISTEN      829/smbd            
tcp        0      0 127.0.0.1:5939          0.0.0.0:*               LISTEN      962/dnsmasq         
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1097/sshd           
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      5584/cupsd          
tcp        0      0 127.0.0.1:2812          0.0.0.0:*               LISTEN      829/smbd            
tcp        0      0 0.0.0.0:5666            0.0.0.0:*               LISTEN      1334/nrpe           
�root@server:~# 

When checking with lsof get to know the running process:

# lsof -n -i tcp:8080
COMMAND PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
java    959 tomcat   47u  IPv6  15556      0t0  TCP *:http-alt (LISTEN)

And this is how it was started:

# cat /proc/959/cmdline
/usr/lib/jvm/java-8-oracle/bin/java-Djava.util.logging.config.file=/opt/tomcat/conf/logging.properties-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager-Djava.awt.headless=true-Djava.security.egd=file:/dev/./urandom-Djdk.tls.ephemeralDHKeySize=2048-Djava.protocol.handler.pkgs=org.apache.catalina.webresources-Xms512M-Xmx1024M-server-XX:+UseParallelGC-Djava.endorsed.dirs=/opt/tomcat/endorsed-classpath/opt/tomcat/bin/bootstrap.jar:/opt/tomcat/bin/tomcat-juli.jar-Dcatalina.base=/opt/tomcat-Dcatalina.home=/opt/tomcat-Djava.io.tmpdir=/opt/tomcat/temporg.apache.catalina.startup.Bootstrapstart

Distribution is Ubuntu 14.04 and netstat version is:

# netstat -V
net-tools 1.60
netstat 1.42 (2001-04-15)
  • 1
    Have you tried the -W flag to disable addresses truncation? – Eduardo Baitello Oct 13 '17 at 13:33
  • Tried it now, got this: # netstat -W /bin/scnetstat: unrecognized option: W – aaditya1234 Oct 13 '17 at 17:02
  • pipe the output through cat -e to escape any bizarre characters. – meuh Oct 13 '17 at 17:44
  • Get this: # netstat -tlnp | cat -e Active Internet connections (only servers)$ ... tcp 0 0 0.0.0.0:5666 0.0.0.0:* LISTEN 1334/nrpe $ M-^?root@server:~# The mystery remains! – aaditya1234 Oct 14 '17 at 6:44
  • You could try prefixing the command with strace -x -s 999 -e write -o /tmp/out and so get the strings being written in the tmp file, with hex for the non-printable. You may need to remove the -e write to dump more system calls and their strings. – meuh Oct 15 '17 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.