Questions tagged [netstat]

analysis tool for statistics about active connections, open sockets, routing tables; in general the networking subsystem.

Filter by
Sorted by
Tagged with
1
vote
0answers
12 views

ss is slow when process option (-p) used

When checking for process listening on port using ss command, it's slow when compared with (obsolete) netstat command. $ time ss -nlp | grep -E ':8081|:8007|:8010' LISTEN 0 100 ...
1
vote
1answer
21 views

What does the reordering field of ss --info mean?

ss --info returns information about tcp connections. It produces a line simliar to the following (some fields removed for formatting) tcp ESTAB 0 0 192.168.1.177:60236 54.70.141.88:...
0
votes
1answer
11 views

Find the short-lived process that is polling my port?

I've noticed one of the headless computers in my network is constantly polling the VNC port on another computer. My problem is, that when I see the port from which it has connected (with tcpdump) and ...
1
vote
0answers
17 views

IGMPv3 Source Filtering Configuration

I know that multicast addresses are being kept in /proc/net/igmp. Where is the configuration for v3 source filter being kept? Please note that I do not wish to inspect actual IGMP packets, I wish to ...
-7
votes
1answer
60 views

Strange logs in Linux [closed]

I ran sudo lsof -i :80 on port 80 to check what is port 80 listening to and I got the output bellow. I dont understand what this means. It seems like some program is running on our server and using ...
-1
votes
1answer
56 views

How do I get my terminal to show the entire output of my command?

terminal command: watch netstat -nalp I get an output, but I am not able to scroll down to see the majority of the output. I can only see as far down as I extend the bottom of the terminal (box). I ...
5
votes
0answers
215 views

What network connections are not seen by netstat/lsof/ss?

Network monitoring tools ss, lsof -i, netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with ip we can see other ...
0
votes
1answer
17 views

app.asar --nod ? What programme is it (in my netstat statistics?

What is app.asar --nod? jerzy@jerzy:~$ sudo netstat -tupln [sudo] password for jerzy: Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program ...
1
vote
0answers
64 views

What does the inode column in netstat signify?

Issuing the command, netstat -pulet, there is an inode column that appears, and so issuing a find command I found that it links to inodes in the /sys/kernel/slab/cgroup/<...> section. For ...
0
votes
0answers
149 views

netstat command for popular IP addresses OK in CentOS 6, fails in CentOS 7

In CentOS 6 w/ OpenVZ 2.6.32, this command outputs IPs with the highest number of connections against port 22, e.g: [root@legovz ~]# netstat -antu | grep :22 | grep -v LISTEN | awk '{print $5}' | cut ...
1
vote
1answer
88 views

Why does postgresql server have a `localhost:57504` to `localhost:57504` UDP “connection”?

$ sudo netstat -ap | grep postg tcp 0 0 localhost:postgresql 0.0.0.0:* LISTEN 1567/postgres udp 0 0 localhost:57504 localhost:57504 ...
-3
votes
1answer
121 views

What do `0.0.0.0:*`, `[::]:mysql`, and `[::]:*` mean in netstat output?

$ sudo netstat -ap | grep postg tcp 0 0 localhost:postgresql 0.0.0.0:* LISTEN 1567/postgres udp 0 0 localhost:57504 localhost:57504 ...
0
votes
1answer
20 views

Does `netstat` output different sockets with and without -n?

man netstat says --numeric, -n Show numerical addresses instead of trying to determine symbolic host, port or user names. Does netstat output additional sockets with -n than without -n? Or ...
1
vote
0answers
19 views

System statistics from different utilities don't agree

I am running an Aliyun instance with 8 vCPUs to do some high performance computing, so I want to make full use of the machine. In other words, extremely high CPU usage is not a problem; instead it is ...
0
votes
2answers
82 views

How can I find the mapping on `$DISPLAY` after `ssh -X`?

On machine B, I remote access machine C $ ssh -X t@C $ echo $DISPLAY localhost:10.0 How can I find/verify the mapping of $DISPLAY on C to $DISPLAY on B? Can it be done by the following command ...
1
vote
1answer
46 views

confused by netstat result

I ssh to my ubuntu server and run sudo netstat -a -p and I get this: tcp 0 0 ip-172-31-25-123.us:ssh mailDOTjjtoursDOTcom:54531 ESTABLISHED 1516/sshd: ubuntu [ And when I use my other ...
2
votes
1answer
61 views

Red Hat Linux - port is in listening state but could not find process ID

I have this problem for my application, port is in listening state but process ID is not showing up. Used below commands. This is cloud AWS server Red Hat Linux. $ netstat -tulpn tcp 0 ...
0
votes
0answers
18 views

Question on Netstat output “app --node-in” & other

While doing "netstat -p", I got result out of which, I am unable to understand below output:- unix 3 [ ] STREAM CONNECTED 3889891 23976/app --node-in unix 3 [ ] STREAM CONNECTED 33223 ...
0
votes
2answers
165 views

How can I verify that the port forwarding is established by checking the sockets?

After I run $ ssh -L 9000:google.com:80 testme@localhost how can I verify that the port forwarding is established by checking the sockets (internet and unix domain sockets)? Thanks.
0
votes
0answers
290 views

Tcp TCPBacklogDrop and packets pruned from receive queue

I am analyzing two virtual machines in the same LAN, tcp packet loss problem, but the knowledge has been exhausted. platform CentOS Linux release 7.2.1511 (Core) 3.10.0-327.el7.x86_64 #1 SMP Thu Nov ...
2
votes
1answer
639 views

reading TCP connection list from /proc

I'm trying to implement code that enumerate all existing TCP connections per process (similar to netstat -lptn). I prefer to implement it myself and not to rely on netstat. In order to do that, I'm ...
0
votes
1answer
70 views

Process appear by “netstat” but doesn't appear by “ps -a”

I have a machine in my organization that I sshed and received a terminal. When I run netstat -ntlp I received: [root@webtl1 ~]# netstat -ntlp Active Internet connections (only servers) Proto ...
1
vote
2answers
103 views

What is the server-client relationship between a terminal emulator, a window manager and a X server processes?

In APUE (see the figure below), how do a terminal emulator process and a window manager (e.g. openbox) process communicate? Is a temrinal emulator process a client of a window manager process, based ...
-2
votes
1answer
74 views

Is a terminal emulator process a server? [duplicate]

Is a temrinal emulator process a server? If yes, what is its client(s)? How can I find out its client(s)? Thanks. netstat output contains lxterminal processes. Does that mean that a terminal ...
2
votes
1answer
74 views

Why doesn't `netstat` show Screen client but only Screen server process?

From https://unix.stackexchange.com/a/485290/674 Further down in the netstat output is UNIX sockets: Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State ...
0
votes
2answers
35 views

How can I find out the Screen server process?

Does GNU Screen have a server-client architecture model? Is each Screen session a Screen client process? Why can't I find out the Screen server process, but only its session processes i.e. ...
0
votes
0answers
244 views

Whose `I-Node` does `netstat -ap` for unix domain sockets refer to?

What does I-Node mean in the output of netstat -ap for unix domain sockets? It seems not the same as the inode of the socket file: $ netstat -ap ... Active UNIX domain sockets (servers and ...
0
votes
1answer
91 views

How to close nc port in Debian 9?

I am struggling to close these ports which seem to be backdoors -- or at least I have never opened and used them. How can I close or shutdown nc and close these ports? netstat -lntup | grep nc ps-...
-1
votes
1answer
88 views

Why does atop open a raw socket?

I install atop on Debian 9. It runs as a monitoring daemon. Why is it listening on a raw socket? Raw sockets are used to generate arbitrary IPv4 packets or capture all packets read all packets for ...
0
votes
1answer
430 views

ss shows a raw socket. What does it mean that it is listening on “*:ipproto-255”?

What does ss mean by *:ipproto-255, in the local address/port column? $ sudo ss -ap | grep -vE "^(nl |u_)" Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port p_raw UNCONN 0 ...
0
votes
0answers
70 views

Performance of active port - netstat

Below command [root@machine1 output]# netstat -s --udp IcmpMsg: InType0: 371137 InType3: 296 InType8: 386843 InType11: 4 InType13: 141 InType15:...
2
votes
0answers
244 views

netstat show a listen port but pid don't exist and can't find it with lsof

I am running macOS(0.13.6) and while trying to test tinc, I get a warning that port 0.0.0.0:655 is already in use. This is the output I get from netstat: $ sudo netstat -anv -p udp Active Internet ...
0
votes
1answer
70 views

Monitor Nextcloud connections with netstat

I'm not able to detect incoming connections from Nextcloud sync clients via netstat on my server. I have a server in my LAN, running Nextcloud with MySQL in docker containers. I use multiple ...
2
votes
2answers
68 views

Using a if/else statement in shell for netsat

My goal is to ensure that email connections are limited to outbound only So I have two shell commands one is netstat -an | grep ':25' | grep -v '127.0.0.1' | wc -l which prints out 1 The command ...
1
vote
1answer
43 views

How to check which interface(s) a service is bound to?

netstat and similar commands provide information on services bound to an IP. This information is however limited when a service binds to "all available interfaces": root@srv ~# netstat -tulpn | grep ...
0
votes
2answers
113 views

Looking for clarification on netstat results

I am looking for some clarification on the following netstat results. The following results are showing 3 java processes. Is there a way to find which java programs are they referring to? Another ...
0
votes
1answer
63 views

List TCP connections

How can I format netstat output so I have a list of TCP connections made to the server? A bit like this: 192.168.234.1 51780 192.168.234.221 51444 192.168.234.251 51447 The closest I got was six ...
0
votes
1answer
256 views

Two local address listening on same port?

How is it possible that netstat -a | grep 8081 shows this: localhost.8081 *.* 0 0 49152 0 LISTEN *.8081 *.* 0 0 49152 ...
1
vote
1answer
96 views

Significance of output of netstat -i command in AIX

The output of the netstat-i command on AIX 7.1 / AIX 7.2 : Name Mtu Network Address Ipkts Ierrs Opkts Oerrs Coll en0 65390 link#2 e2.f9.3a.a8.fc.2 1205 0 71 ...
1
vote
2answers
3k views

Is there documentation for /proc/net/netstat and /proc/net/snmp?

There is a long list of stats in /proc/net/netstat and /proc/net/snmp, both of which I think come from the net-tools project. Is there any official or unofficial documentation about these fields? Or ...
1
vote
1answer
188 views

Difference of interfaces in netstat -i and netstat -i 1 1 command

Result of the netstat -i command in Solaris: # netstat -i Name Mtu Net/Dest Address Ipkts Ierrs Opkts Oerrs Collis Queue lo0 8232 loopback localhost 179 0 179 0 ...
0
votes
1answer
331 views

Are the 'Local Address' and 'Remote Address' netstat columns symmetrical for localhost?

If I have the following netstat output: Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:3306 127.0.0.1:21950 ...
1
vote
1answer
6k views

How to figure out the meaning behind Recv-Q and Send-Q from netstat?

netstat -ntp Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 8216172 0 127.0.0.1:9503 ...
2
votes
2answers
959 views

Incoming and outgoing traffic when NOTHING is running

In a system with nothing running (at least nothing I know of). Listening of incoming and outgoing traffic prints this output: 192.168.1.1 => all-systems.mcast.net 0b ...
3
votes
1answer
440 views

--numeric-ports option for netstat

$ netstat --version net-tools 1.60 netstat 1.42 (2001-04-15) Fred Baumgarten, Alan Cox, Bernd Eckenfels, Phil Blundell, Tuan Hoang and others +NEW_ADDRT +RTF_IRTT +RTF_REJECT +FW_MASQUERADE +I18N AF: (...
0
votes
2answers
77 views

Capture internet traffic on single interface

I have been asked by a customer to provide a list of all URL's that my company's linux server connects to in order to complete a software update including individual TCP,UDP ports that these ...
1
vote
0answers
87 views

Show bound socket (but not listen) process

I am trying to understand how bind() works. I open a socket, and bind it to port 5001, but I don't execute listen() on it: sockfd = socket(AF_INET, SOCK_STREAM, 0); /* Initialize socket structure */ ...
1
vote
1answer
72 views

Open connections with unresolvable domain

Output of sudo watch lsof -i and sudo watch netstat -tp show ESTABLISHED connections with unresolvable domain (e.g., host, dig woldn't resolve, trying to access domain directly via URL from firefox ...
0
votes
1answer
637 views

sudo netstat -antp not showing PID

i am testing stuff with sockets and i encountered that strange case : i coded i very simple tcp server in c, i made it block after accept(), just to see what happen when accepting multiple connection ...
0
votes
1answer
613 views

Why do RX-OK and TX-OK increase

I'm testing my linux server with the command netstat -i. I just want to know what enp2s0f0 means. Each time that I execute netstat -i, its RX-OK and TX-OK always increase. What does this mean?