Skip to main content

Questions tagged [netstat]

analysis tool for statistics about active connections, open sockets, routing tables; in general the networking subsystem.

Filter by
Sorted by
Tagged with
0 votes
0 answers
32 views

linux + how to close connection that are not in used

from netstat -anp | grep :8088 | grep EST we can see the following connection ( is example from our hadoop server ) tcp 0 0 192.83.23.112:42360 192.83.66.114:8088 ESTABLISHED ...
yael's user avatar
  • 13.4k
0 votes
2 answers
138 views

Where does ss command gather its data for ports etc

When trying to see port clashes within my system, many websites online recommend using /etc/services or ss -tunl to see port info I am noticing /etc/services is providing different information to -ss ...
Rachel1983's user avatar
0 votes
0 answers
70 views

How to see all tcp ports listened on locally

I have a WSL2 instance with Ubuntu 22.04. I have installed microk8s and enabled the local registry. The local Registry in microk8s listens on node port 32000. I can access this registry in WSL on both ...
maloo's user avatar
  • 101
0 votes
2 answers
108 views

Why using grep for some netstat commands require sudo priv?

System: Ubuntu 20.04.06 net-tools 2.10-alpha grep (GNU grep) 3.4 If I run netstat without sudo I see port information and no process information. This is expected as process information requires ...
Dave's user avatar
  • 621
2 votes
1 answer
59 views

Old 43BSD and netstat output

On old 43BSD... netstat -f unix Active UNIX domain sockets Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr 801ca38c dgram 0 0 8008b5c0 0 0 0 /dev/...
elbarna's user avatar
  • 12.8k
0 votes
1 answer
262 views

Can you widen the columns in netstat, specifically "PID/Program name" ...?

There is an old post about line truncation in netstat (Netstat output line width limit) but my question is a bit different. I'm using netstat (net-tools 2.10) on Debian 12. My primary use is to list ...
LiamF's user avatar
  • 155
6 votes
2 answers
1k views

Given a service name, get its port number?

Hi I feel like this is an obvious question but I haven't been able to get a good answer so far. Given the name of the service (which I know running on localhost) is there any networking command line ...
First User's user avatar
0 votes
0 answers
91 views

Established but hidden TCP connection

On computer 10.196.111.161, I can see the following established tcp connection: [10.196.111.161]# netstat -natp | grep 7000 Proto Recv-Q Send-Q Local Address Foreign Address State ...
meolic's user avatar
  • 101
0 votes
2 answers
92 views

How netstat is able to read route tables?

For my php containers if I need to detect the ip where ide listens to. I run: ip=$(netstat -rn | grep "^0.0.0.0 " | cut -d " " -f10) And I get the gateway IP. But for that I need ...
Dimitrios Desyllas's user avatar
0 votes
0 answers
17 views

Disparity between file-nr and netstat

> netstat | grep :389 | grep ESTABLISHED | wc -l 2116 > cat /proc/sys/fs/file-nr 1920 0 3178047 how can a subset of the number of tcp connections be more than the total number of file ...
soupybionics's user avatar
1 vote
1 answer
622 views

How to list the connections of the port forwarded by firewalld?

I have forwarded a port using firewalld, and everything is functioning properly. However, the 'netstat' and 'ss' commands do not display the port opened by firewalld, nor do they show the connections. ...
Blake Candy's user avatar
0 votes
1 answer
132 views

netstat output: unexpected kind 634 which 0x27

When running the netstat -tuln command on macOS terminal I get a strange output at the bottom: ... truncated... e85ca8f83c2f500b dgram 0 0 0 e85ca8f83c2f3fa3 0 ...
I'm Root James's user avatar
1 vote
1 answer
49 views

Linux Webserver not "Accepting" Connections

First off, thanks for any help anyone can provide, I greatly appreciate it! I have a basic network I have set up for testing. It has pfSense acting as a Gateway/DHCP/DNS host and two Linux machines ...
Twigg90's user avatar
  • 11
0 votes
0 answers
180 views

'curl' command works intermittently

I am trying to install and configure a high availability RKE2 cluster (Rancher Kubernetes Engine 2). My architecture consists of 4 VMs: one with DNS and LoadBalancer configured, another with the ...
Karima FATHI's user avatar
1 vote
1 answer
472 views

ss or ip equivalent to netstat -gn to show multicast memberships?

Is there a modern Linux tool that will show the equivalent of netstat -gn to show multicast group memberships? This old command shows output like this: IPv6/IPv4 Group Memberships Interface ...
Mike S's user avatar
  • 2,592
0 votes
0 answers
3k views

How to use netstat to view a list of active TCP and UDP connections and count them?

I want to monitor the number of active TCP and UDP connections using the netstat command. I tried to run the following command: netstat -a | grep -e tcp -e udp | awk '{print $1,$6}' | sort | uniq -c ...
Łukasz D. Tulikowski's user avatar
0 votes
0 answers
24 views

Find "offending" script/file cause multiple connections and hogging resources

I am using a Linux VPS running Cyberpanel/CentOS and PHP 7.4. Using htop and netstat, I can see that there are tons of TCP connections open when my VPS server/website stops responding. I have ...
gurji999's user avatar
1 vote
0 answers
148 views

Why is there more `time_wait` displayed in `sockstat` than it actually is?

Why is there more time_wait displayed in /proc/net/sockstat than it actually is? And how to fix it? [root@node09 ~]# netstat -ant | grep TIME_WAIT | wc -l 28 [root@node09 ~]# netstat -ant|awk '/^tcp/ ...
LiangZheng's user avatar
0 votes
0 answers
108 views

why netstat shows a digit as a program name for established ssh connections?

When I run netstat -antplu, I see entries like below, where a digit is shown for "Program name". These entries are related to established ssh connections. But why does it show a digit as the ...
Manjula's user avatar
  • 101
0 votes
2 answers
114 views

why iptables commands yield seemingly contradictory results on my embeded Linux?

I'm running an Embedded Linux system, whose kernel is 3.18.21, with some applications on top it on MIPS. When I run iptables & ip6tables on the Linux, such as the following: iptables -A INPUT -p ...
li_jessen's user avatar
  • 213
0 votes
3 answers
2k views

netstat not display open ports but I can telnet to the open port

The ports isn't being display when I run netstat netstat -nal | grep 2237 tcping does show that the port is open C:\Users\slee>tcping 172.29.69.250 2237 Probing 172.29.69.250:2237/tcp - Port is ...
supmethods's user avatar
0 votes
1 answer
2k views

Find out what process is listening on a specific port

For the first time in my life, I am unable to figure out what process is listening on a specific port in Linux :) This is an Ubuntu Server 22.04 installation, running K8s. There is an ingress ...
Bogd's user avatar
  • 101
0 votes
0 answers
125 views

Understanding netstat: are these TCP connections actually direct ones?

I am reading about networks, and in an example output table from netstat -n (from visiting a hypothetical website hosted from 216.40.231.195), my book shows a row that looks like this: Proto Local ...
landau's user avatar
  • 101
2 votes
0 answers
213 views

What Is The Order Of Netstat Ports Displayed?

I display the port of certain process type for an environment using netstat and the pid netstat -pant| grep LISTEN | grep 100452 There are always 2 ports for this process type (e.g. 8107 and 8112), ...
opticyclic's user avatar
1 vote
1 answer
167 views

CLOSE_WAIT not visible on the kubernetes node

Debugging a tcp: out of memory error, I found that a process (from a container) has a lot of connection on CLOSE_WAIT status aka 08 when I cat /proc/XXX/net/tcp But neither netstat or ss were showing ...
Ôrel's user avatar
  • 315
1 vote
1 answer
429 views

Number of open sockets in /proc/pid/fd does not agree with netstat

I'm running into a weird socket issue when running my own crawler. It opens and cloees a lot of TCP sockets rapidly due to the protocol design. It's something I have to live with. I'm very sure in ...
Mary Chang's user avatar
0 votes
1 answer
227 views

Am I being hacked? can any one read this copy/paste netstat -ano?

i have an hp elitebook laptop with Linux mint and I have opened Firefox browser with four tabs: an empty tab and three from the streaming website solarmovie.zone Even though no streaming is running ...
khalid's user avatar
  • 1
-1 votes
2 answers
1k views

how to Find the port number according to PID [duplicate]

The following command can be used to find out which process is listening on a particular port: netstat -ltnp | grep -w ':8011' How can we do the opposite, find the port number according to PID ...
yael's user avatar
  • 13.4k
0 votes
0 answers
672 views

get data from socket on port

I have a specific service that sends data on port 5555. I need to open socket on shell unix to listen on this port and print output on shell. Service is deployed as docker container. So, I run ...
init's user avatar
  • 31
0 votes
0 answers
19 views

network services reachability troubleshooting

I have voyage linux on a system. It is running an apache server and an sshd. For some reason, i cannot connect to those services from another machine. There are no error logs that i have been able to ...
atapaka's user avatar
  • 591
2 votes
1 answer
884 views

How to find a process by network domain it requests?

I noticed my Linux machine makes many DNS queries for a specific domain (subdomain) malicious.foo.bar How can I find out which application or process tries to resolve this domain? I also want to see ...
Łukasz D. Tulikowski's user avatar
0 votes
1 answer
1k views

Can two servers bind the same port?

I was surprised to discover that two servers I'm maintaining are both able to listen on port 3000 in development at the same time. With the first server running, netstat shows ▶ sudo netstat -nap ...
Pathogen's user avatar
  • 103
0 votes
1 answer
217 views

Sorting lines based on certain digit pattern

Assume I have a text file with the following lines: 192.168.1.1.55555 192.168.1.1.55555 192.168.1.1.5555 192.168.1.1.555 192.168.1.1.55 192.168.1.1.55 192.168.1.1.5 8.8.8.8.4433 8.8.8.8.443 8.8.8.8....
Zarkos.Fina's user avatar
0 votes
1 answer
2k views

How to show the "syn_sent" socket state on Linux in realtime?

I want to see the state "syn_sent" of socket in realtime during the connection process ss or netstat or any command I have tried those commands, but all fail watch netstat -tnaop|grep -i syn ...
elbarna's user avatar
  • 12.8k
0 votes
1 answer
266 views

View extended stats for listening ports (using ss?)

With ss -tuiOp we can view extended stats for an outbound process, e.g.: tcp ESTAB 0 0 192.168.68.108:32862 52.86.220....
user717847's user avatar
1 vote
1 answer
256 views

Fresh Fedora 35 - what are these active internet connections doing?

To get to this point I had a Fedora workstation 34 install- iso about a week old - ran update, rebooted, click Install Fedora 35 as it was on offer from gnome Software. Hadn't even opened Firefox yet. ...
bluesquare's user avatar
2 votes
1 answer
988 views

Which interface does a specific IP address will get routed over?

Is there a way to determine which netdev or IP link interface that a given IP address will route over … in bash/shell language? This is not about what an IP address is, given a network device name. ...
John Greene's user avatar
1 vote
1 answer
540 views

rhel + any best practice to minimize the CLOSE_WAIT sessions from linux side

when we perform the following cli on our rhel machine we get more then 600 CLOSE_WAIT lines lsof -i tcp:8088 | grep CLOSE_WAIT java 31100 yarn 385u IPv4 208022048 0t0 TCP master02.hgti.com:...
yael's user avatar
  • 13.4k
0 votes
1 answer
454 views

how to know what the process that connected to my machine VIA specific port

with the following command I want to get which are the IP's that connected on my machine with port 8088 18.23.292.9 is machine that resource manager service is running on with port 8088 ss -tanp | ...
yael's user avatar
  • 13.4k
2 votes
1 answer
2k views

netstat cannot find opened port by iptables

My Linux command is following: iptables -I INPUT -p tcp --dport 5002 -j ACCEPT iptables-save netstat -natp but the result of netstat has no item about 5002.
GallopingRooster's user avatar
2 votes
1 answer
640 views

iproute2 ss - not showing process/pid information if user is not the same user as listening process?

Is it normal behavior, or a bug, that when I run ss -nltp, I only see the process/pid information if the user I am running ss -nltp as is the same user as the listening process? $ docker run -it --rm ...
rmf's user avatar
  • 133
0 votes
1 answer
1k views

Random SSH Agent Generates on Boot in tmp Directory Even with Networking Disabled

On a recently installed Debian system I noticed that every boot, even with no networking, a folder and empty socket file are generated in /tmp/ssh-(random_letters)/agent.xxx. On every boot the random ...
emptysocket's user avatar
1 vote
2 answers
159 views

How I can grep data with some spaces and ignoring block?

I am trying to retrieve Local Address-port with port number in different block used by each IP-address in Foreign Address and PID/Program name) from the following and store it in a file: I used: ...
Tech Parinda's user avatar
4 votes
1 answer
2k views

How to find applications/ports that do bind() but don't do listen()?

When a faulty application calls bind() with a TCP socket to a port P but does not follow with listen(), the port P is not listed among open ports, i.e. netstat or ss or ls /proc/net/tcp do not show it,...
volferine's user avatar
  • 143
0 votes
1 answer
2k views

How can I get CentOS to correctly list open ports?

I am working with CentOS 7 OS hosting a set of docker containers. By using a web browser I can reach a service on port 80 and I get back a response. A bit of local knowledge helps me understand that ...
Tony Sepia's user avatar
1 vote
1 answer
1k views

netstat -lnp outputing results without PID

After using netstat -lnp I wonder how comes some of the result don't show any PID/Program name? Should I be worried? See below: Active Internet connections (only servers) Proto Recv-Q Send-Q Local ...
Antonin GAVREL's user avatar
0 votes
0 answers
167 views

How can I find out which processes are using my ports? Weird netstat output [duplicate]

I am trying to start a server that listens on 8080, but getting an error that the port is already in use. I am not running anything using that port. Running netstat -ano -p tcp | grep tcp6 shows ...
Joram's user avatar
  • 1
-1 votes
3 answers
190 views

Can anyone get the default ip using only netstat -rn, while, read, and cut command?

As you can imagine, I should only use these commands to get the default IP of my virtual machine. netstat -rn gives the following output Kernel IP routing table Destination Gateway Genmask ......
OneMoreGamble's user avatar
4 votes
1 answer
16k views

What does address 224.0.0.251:5353 represent?

I read some tutorials,they say that netstat is deprecated. I tried ss command. THis is the output Netid State Recv-Q Send-Q Local Address:Port ...
TrajcheS's user avatar
1 vote
0 answers
1k views

socket statistics (ss) program weird ipv6 listening socket address format

I have two services listening on TCP/IPv6 sockets, ssh and mysql. ss shows this: $ ss -tl6 State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 ...
spinkus's user avatar
  • 491

1
2 3 4 5 6