Questions tagged [netstat]
analysis tool for statistics about active connections, open sockets, routing tables; in general the networking subsystem.
185
questions
1
vote
0answers
12 views
ss is slow when process option (-p) used
When checking for process listening on port using ss command, it's slow when compared with (obsolete) netstat command.
$ time ss -nlp | grep -E ':8081|:8007|:8010'
LISTEN 0 100 ...
1
vote
1answer
21 views
What does the reordering field of ss --info mean?
ss --info returns information about tcp connections. It produces a line simliar to the following (some fields removed for formatting)
tcp ESTAB 0 0 192.168.1.177:60236 54.70.141.88:...
0
votes
1answer
11 views
Find the short-lived process that is polling my port?
I've noticed one of the headless computers in my network is constantly polling the VNC port on another computer. My problem is, that when I see the port from which it has connected (with tcpdump) and ...
1
vote
0answers
17 views
IGMPv3 Source Filtering Configuration
I know that multicast addresses are being kept in /proc/net/igmp. Where is the configuration for v3 source filter being kept? Please note that I do not wish to inspect actual IGMP packets, I wish to ...
-7
votes
1answer
60 views
Strange logs in Linux [closed]
I ran sudo lsof -i :80 on port 80 to check what is port 80 listening to and I got the output bellow.
I dont understand what this means. It seems like some program is running on our server and using ...
-1
votes
1answer
56 views
How do I get my terminal to show the entire output of my command?
terminal command: watch netstat -nalp
I get an output, but I am not able to scroll down to see the majority of the output. I can only see as far down as I extend the bottom of the terminal (box). I ...
5
votes
0answers
215 views
What network connections are not seen by netstat/lsof/ss?
Network monitoring tools ss, lsof -i, netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with ip we can see other ...
0
votes
1answer
17 views
app.asar --nod ? What programme is it (in my netstat statistics?
What is app.asar --nod?
jerzy@jerzy:~$ sudo netstat -tupln
[sudo] password for jerzy:
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program ...
1
vote
0answers
64 views
What does the inode column in netstat signify?
Issuing the command, netstat -pulet, there is an inode column that appears, and so issuing a find command I found that it links to inodes in the /sys/kernel/slab/cgroup/<...> section.
For ...
0
votes
0answers
149 views
netstat command for popular IP addresses OK in CentOS 6, fails in CentOS 7
In CentOS 6 w/ OpenVZ 2.6.32, this command outputs IPs with the highest number of connections against port 22, e.g:
[root@legovz ~]# netstat -antu | grep :22 | grep -v LISTEN | awk '{print $5}' | cut ...
1
vote
1answer
88 views
Why does postgresql server have a `localhost:57504` to `localhost:57504` UDP “connection”?
$ sudo netstat -ap | grep postg
tcp 0 0 localhost:postgresql 0.0.0.0:* LISTEN 1567/postgres
udp 0 0 localhost:57504 localhost:57504 ...
-3
votes
1answer
121 views
What do `0.0.0.0:*`, `[::]:mysql`, and `[::]:*` mean in netstat output?
$ sudo netstat -ap | grep postg
tcp 0 0 localhost:postgresql 0.0.0.0:* LISTEN 1567/postgres
udp 0 0 localhost:57504 localhost:57504 ...
0
votes
1answer
20 views
Does `netstat` output different sockets with and without -n?
man netstat says
--numeric, -n
Show numerical addresses instead of trying to determine symbolic host,
port or user names.
Does netstat output additional sockets with -n than without -n?
Or ...
1
vote
0answers
19 views
System statistics from different utilities don't agree
I am running an Aliyun instance with 8 vCPUs to do some high performance computing, so I want to make full use of the machine. In other words, extremely high CPU usage is not a problem; instead it is ...
0
votes
2answers
82 views
How can I find the mapping on `$DISPLAY` after `ssh -X`?
On machine B, I remote access machine C
$ ssh -X t@C
$ echo $DISPLAY
localhost:10.0
How can I find/verify the mapping of $DISPLAY on C to $DISPLAY on B? Can it be done by the following command ...
1
vote
1answer
46 views
confused by netstat result
I ssh to my ubuntu server and run sudo netstat -a -p and I get this:
tcp 0 0 ip-172-31-25-123.us:ssh mailDOTjjtoursDOTcom:54531 ESTABLISHED 1516/sshd: ubuntu [
And when I use my other ...
2
votes
1answer
61 views
Red Hat Linux - port is in listening state but could not find process ID
I have this problem for my application, port is in listening state but process ID is not showing up. Used below commands. This is cloud AWS server Red Hat Linux.
$ netstat -tulpn
tcp 0 ...
0
votes
0answers
18 views
Question on Netstat output “app --node-in” & other
While doing "netstat -p", I got result out of which, I am unable to understand below output:-
unix 3 [ ] STREAM CONNECTED 3889891 23976/app --node-in
unix 3 [ ] STREAM CONNECTED 33223 ...
0
votes
2answers
165 views
How can I verify that the port forwarding is established by checking the sockets?
After I run
$ ssh -L 9000:google.com:80 testme@localhost
how can I verify that the port forwarding is established by checking the sockets (internet and unix domain sockets)?
Thanks.
0
votes
0answers
290 views
Tcp TCPBacklogDrop and packets pruned from receive queue
I am analyzing two virtual machines in the same LAN, tcp packet loss problem, but the knowledge has been exhausted.
platform
CentOS Linux release 7.2.1511 (Core)
3.10.0-327.el7.x86_64 #1 SMP Thu Nov ...
2
votes
1answer
639 views
reading TCP connection list from /proc
I'm trying to implement code that enumerate all existing TCP connections per process (similar to netstat -lptn).
I prefer to implement it myself and not to rely on netstat.
In order to do that, I'm ...
0
votes
1answer
70 views
Process appear by “netstat” but doesn't appear by “ps -a”
I have a machine in my organization that I sshed and received a terminal.
When I run netstat -ntlp I received:
[root@webtl1 ~]# netstat -ntlp
Active Internet connections (only servers)
Proto ...
1
vote
2answers
103 views
What is the server-client relationship between a terminal emulator, a window manager and a X server processes?
In APUE (see the figure below), how do a terminal emulator process and a window manager
(e.g. openbox) process communicate? Is a temrinal emulator process
a client of a window manager process, based ...
-2
votes
1answer
74 views
Is a terminal emulator process a server? [duplicate]
Is a temrinal emulator process a server?
If yes, what is its client(s)? How can I find out its client(s)? Thanks.
netstat output contains lxterminal processes. Does that mean that
a terminal ...
2
votes
1answer
74 views
Why doesn't `netstat` show Screen client but only Screen server process?
From https://unix.stackexchange.com/a/485290/674
Further down in the netstat output is UNIX sockets:
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State ...
0
votes
2answers
35 views
How can I find out the Screen server process?
Does GNU Screen have a server-client architecture model?
Is each Screen session a Screen client process?
Why can't I find out the Screen server process, but only its session processes i.e. ...
0
votes
0answers
244 views
Whose `I-Node` does `netstat -ap` for unix domain sockets refer to?
What does I-Node mean in the output of netstat -ap for unix domain sockets?
It seems not the same as the inode of the socket file:
$ netstat -ap
...
Active UNIX domain sockets (servers and ...
0
votes
1answer
91 views
How to close nc port in Debian 9?
I am struggling to close these ports which seem to be backdoors -- or at least I have never opened and used them. How can I close or shutdown nc and close these ports?
netstat -lntup | grep nc
ps-...
-1
votes
1answer
88 views
Why does atop open a raw socket?
I install atop on Debian 9. It runs as a monitoring daemon.
Why is it listening on a raw socket? Raw sockets are used to generate arbitrary IPv4 packets or capture all packets read all packets for ...
0
votes
1answer
430 views
ss shows a raw socket. What does it mean that it is listening on “*:ipproto-255”?
What does ss mean by *:ipproto-255, in the local address/port column?
$ sudo ss -ap | grep -vE "^(nl |u_)"
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
p_raw UNCONN 0 ...
0
votes
0answers
70 views
Performance of active port - netstat
Below command
[root@machine1 output]# netstat -s --udp
IcmpMsg:
InType0: 371137
InType3: 296
InType8: 386843
InType11: 4
InType13: 141
InType15:...
2
votes
0answers
244 views
netstat show a listen port but pid don't exist and can't find it with lsof
I am running macOS(0.13.6) and while trying to test tinc, I get a warning that port 0.0.0.0:655 is already in use.
This is the output I get from netstat:
$ sudo netstat -anv -p udp
Active Internet ...
0
votes
1answer
70 views
Monitor Nextcloud connections with netstat
I'm not able to detect incoming connections from Nextcloud sync clients via netstat on my server.
I have a server in my LAN, running Nextcloud with MySQL in docker containers. I use multiple ...
2
votes
2answers
68 views
Using a if/else statement in shell for netsat
My goal is to ensure that email connections are limited to outbound only
So I have two shell commands one is
netstat -an | grep ':25' | grep -v '127.0.0.1' | wc -l
which prints out 1
The command ...
1
vote
1answer
43 views
How to check which interface(s) a service is bound to?
netstat and similar commands provide information on services bound to an IP. This information is however limited when a service binds to "all available interfaces":
root@srv ~# netstat -tulpn | grep ...
0
votes
2answers
113 views
Looking for clarification on netstat results
I am looking for some clarification on the following netstat results. The following results are showing 3 java processes. Is there a way to find which java programs are they referring to?
Another ...
0
votes
1answer
63 views
List TCP connections
How can I format netstat output so I have a list of TCP connections made to the server?
A bit like this:
192.168.234.1 51780
192.168.234.221 51444
192.168.234.251 51447
The closest I got was six ...
0
votes
1answer
256 views
Two local address listening on same port?
How is it possible that netstat -a | grep 8081 shows this:
localhost.8081 *.* 0 0 49152 0 LISTEN
*.8081 *.* 0 0 49152 ...
1
vote
1answer
96 views
Significance of output of netstat -i command in AIX
The output of the netstat-i command on AIX 7.1 / AIX 7.2 :
Name Mtu Network Address Ipkts Ierrs Opkts Oerrs Coll
en0 65390 link#2 e2.f9.3a.a8.fc.2 1205 0 71 ...
1
vote
2answers
3k views
Is there documentation for /proc/net/netstat and /proc/net/snmp?
There is a long list of stats in /proc/net/netstat and /proc/net/snmp, both of which I think come from the net-tools project. Is there any official or unofficial documentation about these fields? Or ...
1
vote
1answer
188 views
Difference of interfaces in netstat -i and netstat -i 1 1 command
Result of the netstat -i command in Solaris:
# netstat -i
Name Mtu Net/Dest Address Ipkts Ierrs Opkts Oerrs Collis Queue
lo0 8232 loopback localhost 179 0 179 0 ...
0
votes
1answer
331 views
Are the 'Local Address' and 'Remote Address' netstat columns symmetrical for localhost?
If I have the following netstat output:
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:3306 127.0.0.1:21950 ...
1
vote
1answer
6k views
How to figure out the meaning behind Recv-Q and Send-Q from netstat?
netstat -ntp
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 8216172 0 127.0.0.1:9503 ...
2
votes
2answers
959 views
Incoming and outgoing traffic when NOTHING is running
In a system with nothing running (at least nothing I know of). Listening of incoming and outgoing traffic prints this output:
192.168.1.1 => all-systems.mcast.net 0b ...
3
votes
1answer
440 views
--numeric-ports option for netstat
$ netstat --version
net-tools 1.60
netstat 1.42 (2001-04-15)
Fred Baumgarten, Alan Cox, Bernd Eckenfels, Phil Blundell, Tuan Hoang and others
+NEW_ADDRT +RTF_IRTT +RTF_REJECT +FW_MASQUERADE +I18N
AF: (...
0
votes
2answers
77 views
Capture internet traffic on single interface
I have been asked by a customer to provide a list of all URL's that my company's linux server connects to in order to complete a software update including individual TCP,UDP ports that these ...
1
vote
0answers
87 views
Show bound socket (but not listen) process
I am trying to understand how bind() works.
I open a socket, and bind it to port 5001, but I don't execute listen() on it:
sockfd = socket(AF_INET, SOCK_STREAM, 0);
/* Initialize socket structure */
...
1
vote
1answer
72 views
Open connections with unresolvable domain
Output of sudo watch lsof -i and sudo watch netstat -tp show ESTABLISHED connections with unresolvable domain (e.g., host, dig woldn't resolve, trying to access domain directly via URL from firefox ...
0
votes
1answer
637 views
sudo netstat -antp not showing PID
i am testing stuff with sockets and i encountered that strange case :
i coded i very simple tcp server in c, i made it block after accept(), just to see what happen when accepting multiple connection ...
0
votes
1answer
613 views
Why do RX-OK and TX-OK increase
I'm testing my linux server with the command netstat -i.
I just want to know what enp2s0f0 means. Each time that I execute netstat -i, its RX-OK and TX-OK always increase. What does this mean?
