This is what I see in Nethogs:


I'm concerned about the listings with PID ?, running as root. How can I find out what these are? I'm running Linux Mint 14.

Please let me know what other information I should include.

  • Are you running nethogs as root? netstat -tap can also show programs related to the connections (if it runs as root). The IPs seems to be some japan yahoo pages. – jofel Sep 17 '13 at 13:49

Those are TCP connections that were used to make an outgoing connection to a website. You can tell from the trailing :80 which is the port that's used for HTTP connections to web servers, typically. After the 3 way TCP connection handshake has completed the connections are left in a "wait to close" state.

This bit is your local system's IP address and that's the port that was used to make the connection to the remote web server:

IP:  PORT: 50161


Here's output from my system using netstat -ant:

tcp        0      0           TIME_WAIT   

Notice the state at the end? It's TIME_WAIT. You can further convince yourself of this by adding the -p switch so we can see what process is bound/associated to this particular connection:

$ sudo netstat -antp | grep

This shows that no process was affiliated with this.

  • 1
    So for non-networking-savvy users, in short... these are not separate processes at all but are connections which were made by my web browser, and which are waiting to close? (In netstat I can see their state is LAST_ACK.) – Alex D Sep 17 '13 at 15:05
  • @AlexD - yes they're waiting to be closed. – slm Sep 17 '13 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.