0

My client is a MS Excel plug-in running on my laptop (client_machine1) that connects to a Solaris server (server1) to request some WebLogic Application running on port 28080.

bash-3.2$ set | grep SSH_CONNECTION
SSH_CONNECTION='<client_machine1 IP Address> 64134 <Server1 IP Address> 22'

bash-3.2$ netstat -a | grep <client_machine1 IP address>
<Server1 FQDN>.28080 <client_machine1 IP address>.49592  260836      0 49950      0 FIN_WAIT_2
<Server1 FQDN>.28080 <client_machine1 IP address>.49595  261216      0 49950      0 FIN_WAIT_2
<Server1 FQDN>.28080 <client_machine1 IP address>.49596  261216      0 49950      0 FIN_WAIT_2
<Server1 FQDN>.ssh <client_machine1 IP address>.64134  65024    135 49950      0 ESTABLISHED

During my client session, I kept checking the output of netstat -a | grep <client_machine1 IP address> to see if my client's IP address shows up. Only for a brief period of time I was able to see it and capture the above output. For the rest of the time I can only see the ssh connection entry. I find this confusing as the client session is active at that time and data exchange is in progress.

Am I missing something here..? I also tried lsof | grep <client_machine1 IP address> but that doesn't return anything.

  • Did you try this again with netstat -n ? Just to be sure that the host isn't resolved to the name at some time and your grep doesn't work? – echox Sep 16 '13 at 11:27
  • @echox - okay I will check that. Just realized that I am connecting to a virtual server that internally forwards my request to server1. I guess I saw my IP when I tried to directly connect to server1.. – Kent Pawar Sep 16 '13 at 11:40
  • 1
    lsof -n -i :28080 – Rahul Patil Sep 16 '13 at 21:10
0

If you do a netstat -a you get just the hostnames and names of services.

Example

$ netstat -a|head -20
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State      
tcp        0      0 *:sunrpc                    *:*                         LISTEN      
tcp        0      0 *:ssh                       *:*                         LISTEN      
tcp        0      0 localhost.localdomain:ipp   *:*                         LISTEN      
tcp        0      0 *:db-lsp                    *:*                         LISTEN      
tcp        0      0 *:58460                     *:*                         LISTEN      
tcp        0      0 *:17501                     *:*                         LISTEN      
tcp        0      0 *:lv-jc                     *:*                         LISTEN      
tcp        0      0 *:ellpack                   *:*                         LISTEN      
tcp        0      0 greeneggs.bubba.net:37050   stackoverflow.com:http      TIME_WAIT   
tcp        0      0 greeneggs.bubba.net:34320   stackoverflow.com:http      ESTABLISHED 
tcp        0      0 greeneggs.bubba.net:34223   stackoverflow.com:http      ESTABLISHED 

There is nothing in this output that will match your IP address, since it's just names. If you want to forgo showing names and just show the numbers, use the -n switch to netstat:

$ netstat -an|head -20
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State      
tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      
tcp        0      0 127.0.0.1:631               0.0.0.0:*                   LISTEN      
tcp        0      0 0.0.0.0:17500               0.0.0.0:*                   LISTEN      
tcp        0      0 0.0.0.0:58460               0.0.0.0:*                   LISTEN      
tcp        0      0 0.0.0.0:17501               0.0.0.0:*                   LISTEN      
tcp        0      0 0.0.0.0:2143                0.0.0.0:*                   LISTEN      
tcp        0      0 0.0.0.0:2025                0.0.0.0:*                   LISTEN      
tcp        0      0 192.168.1.20:36188          198.252.206.16:80           ESTABLISHED 
tcp        0      0 192.168.1.20:37112          198.252.206.25:80           TIME_WAIT   
tcp        0      0 192.168.1.20:37116          198.252.206.25:80           TIME_WAIT   
  • Thanks. Marked as the right answer as the examples help. – Kent Pawar Sep 19 '13 at 16:08
2

You need to use netstat -n if you're going to grep by IP address. Otherwise, you get your machine's host name in the netstat output.

  • +1. Thanks this helps. This helped but seems my request goes through a proxy so my client never connects to the remote server directly and so won't appear in netstat. – Kent Pawar Sep 19 '13 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.