Learning about networks and trying to make sense of netstat output. This is the main confusion:

When I run the command, there are no known URLs. For example, I'm listening a Youtube streaming and was expecting to see UDP for the streaming. Am I expecting something that is not? Any help?

Slice of the output:

tcp        0      0 arco:43424              lhr25s15-in-f1.1e:https ESTABLISHED
udp        0      0 arco:bootpc             ttrouter.lan:bootps     ESTABLISHED

Pretty much anything running in a web browser, like youtube, will use only HTTP and HTTP-based protocols like WebSockets. Web browsers forbid non-HTTP connections by websites for security reasons. So you're not usually going to see UDP, except possibly for HTTP-over-QUIC and HTTP 3.

Looking into the network monitor in firefox while while watching a Video on Youtube, I can see a few requests to URLs like https://r4---sn-4g5e6nzz.googlevideo.com/videoplayback, returning webp (video) content. Also in the firefox network monitor, the remote address is displayed as [2a00:1450:4001:1::9]:443 (IPv6).

Using netstat -tpen I can see a matching connection:

Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name
tcp6       0      0 (censored)              2a00:1450:4001:1::9:443 ESTABLISHED 1000       8120905    8478/firefox
  • very clever. thanks! – Minsky Sep 30 '20 at 22:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.