Questions tagged [netstat]

analysis tool for statistics about active connections, open sockets, routing tables; in general the networking subsystem.

Filter by
Sorted by
Tagged with
0 votes
0 answers
50 views

Established but hidden TCP connection

On computer 10.196.111.161, I can see the following established tcp connection: [10.196.111.161]# netstat -natp | grep 7000 Proto Recv-Q Send-Q Local Address Foreign Address State ...
meolic's user avatar
  • 101
-1 votes
0 answers
30 views

Which process communicate with Unix socket

I see process that has unix socket PID=55 netstat -nxpl | grep 55 I see Proto=unix , State=LISTENING, Inode=1234 pid=55 I can see that Inode in /proc/net/unix How can I know which process communicate ...
Polo1990's user avatar
0 votes
2 answers
45 views

How netstat is able to read route tables?

For my php containers if I need to detect the ip where ide listens to. I run: ip=$(netstat -rn | grep "^0.0.0.0 " | cut -d " " -f10) And I get the gateway IP. But for that I need ...
Dimitrios Desyllas's user avatar
0 votes
0 answers
13 views

Disparity between file-nr and netstat

> netstat | grep :389 | grep ESTABLISHED | wc -l 2116 > cat /proc/sys/fs/file-nr 1920 0 3178047 how can a subset of the number of tcp connections be more than the total number of file ...
soupybionics's user avatar
1 vote
1 answer
23 views

How to list the connections of the port forwarded by firewalld?

I have forwarded a port using firewalld, and everything is functioning properly. However, the 'netstat' and 'ss' commands do not display the port opened by firewalld, nor do they show the connections. ...
Blake Candy's user avatar
0 votes
1 answer
33 views

netstat output: unexpected kind 634 which 0x27

When running the netstat -tuln command on macOS terminal I get a strange output at the bottom: ... truncated... e85ca8f83c2f500b dgram 0 0 0 e85ca8f83c2f3fa3 0 ...
Root James's user avatar
1 vote
1 answer
26 views

Linux Webserver not "Accepting" Connections

First off, thanks for any help anyone can provide, I greatly appreciate it! I have a basic network I have set up for testing. It has pfSense acting as a Gateway/DHCP/DNS host and two Linux machines ...
Twigg90's user avatar
  • 11
0 votes
0 answers
70 views

'curl' command works intermittently

I am trying to install and configure a high availability RKE2 cluster (Rancher Kubernetes Engine 2). My architecture consists of 4 VMs: one with DNS and LoadBalancer configured, another with the ...
Karima FATHI's user avatar
1 vote
1 answer
117 views

ss or ip equivalent to netstat -gn to show multicast memberships?

Is there a modern Linux tool that will show the equivalent of netstat -gn to show multicast group memberships? This old command shows output like this: IPv6/IPv4 Group Memberships Interface ...
Mike S's user avatar
  • 2,432
0 votes
0 answers
24 views

Difference between wireless discarded packet metrics and netstat interface tx errors?

cat /proc/net/wireless on my system returns the following: Inter-| sta-| Quality | Discarded packets | Missed | WE face | tus | link level noise | nwid crypt frag retry ...
Hydrargyrum's user avatar
0 votes
0 answers
324 views

How to use netstat to view a list of active TCP and UDP connections and count them?

I want to monitor the number of active TCP and UDP connections using the netstat command. I tried to run the following command: netstat -a | grep -e tcp -e udp | awk '{print $1,$6}' | sort | uniq -c ...
Łukasz D. Tulikowski's user avatar
0 votes
0 answers
24 views

Find "offending" script/file cause multiple connections and hogging resources

I am using a Linux VPS running Cyberpanel/CentOS and PHP 7.4. Using htop and netstat, I can see that there are tons of TCP connections open when my VPS server/website stops responding. I have ...
gurji999's user avatar
1 vote
0 answers
94 views

Why is there more `time_wait` displayed in `sockstat` than it actually is?

Why is there more time_wait displayed in /proc/net/sockstat than it actually is? And how to fix it? [root@node09 ~]# netstat -ant | grep TIME_WAIT | wc -l 28 [root@node09 ~]# netstat -ant|awk '/^tcp/ ...
LiangZheng's user avatar
0 votes
0 answers
75 views

why netstat shows a digit as a program name for established ssh connections?

When I run netstat -antplu, I see entries like below, where a digit is shown for "Program name". These entries are related to established ssh connections. But why does it show a digit as the ...
Manjula's user avatar
  • 101
0 votes
2 answers
61 views

why iptables commands yield seemingly contradictory results on my embeded Linux?

I'm running an Embedded Linux system, whose kernel is 3.18.21, with some applications on top it on MIPS. When I run iptables & ip6tables on the Linux, such as the following: iptables -A INPUT -p ...
li_jessen's user avatar
  • 103
0 votes
3 answers
791 views

netstat not display open ports but I can telnet to the open port

The ports isn't being display when I run netstat netstat -nal | grep 2237 tcping does show that the port is open C:\Users\slee>tcping 172.29.69.250 2237 Probing 172.29.69.250:2237/tcp - Port is ...
supmethods's user avatar
0 votes
1 answer
958 views

Find out what process is listening on a specific port

For the first time in my life, I am unable to figure out what process is listening on a specific port in Linux :) This is an Ubuntu Server 22.04 installation, running K8s. There is an ingress ...
Bogd's user avatar
  • 101
0 votes
0 answers
85 views

Understanding netstat: are these TCP connections actually direct ones?

I am reading about networks, and in an example output table from netstat -n (from visiting a hypothetical website hosted from 216.40.231.195), my book shows a row that looks like this: Proto Local ...
landau's user avatar
  • 101
2 votes
0 answers
136 views

What Is The Order Of Netstat Ports Displayed?

I display the port of certain process type for an environment using netstat and the pid netstat -pant| grep LISTEN | grep 100452 There are always 2 ports for this process type (e.g. 8107 and 8112), ...
opticyclic's user avatar
1 vote
1 answer
109 views

CLOSE_WAIT not visible on the kubernetes node

Debugging a tcp: out of memory error, I found that a process (from a container) has a lot of connection on CLOSE_WAIT status aka 08 when I cat /proc/XXX/net/tcp But neither netstat or ss were showing ...
Ôrel's user avatar
  • 315
1 vote
1 answer
244 views

Number of open sockets in /proc/pid/fd does not agree with netstat

I'm running into a weird socket issue when running my own crawler. It opens and cloees a lot of TCP sockets rapidly due to the protocol design. It's something I have to live with. I'm very sure in ...
Mary Chang's user avatar
0 votes
1 answer
143 views

Am I being hacked? can any one read this copy/paste netstat -ano?

i have an hp elitebook laptop with Linux mint and I have opened Firefox browser with four tabs: an empty tab and three from the streaming website solarmovie.zone Even though no streaming is running ...
khalid's user avatar
  • 1
1 vote
0 answers
173 views

Turn a script do while to a systemctl service to intercept a tcp connection state

I made a little script that refresh browser, when web-server is down and connection is lost, with an infinite loop do/while true. I want to turn it in a service for a better and clean solution. The ...
Alessandro's user avatar
-1 votes
2 answers
972 views

how to Find the port number according to PID [duplicate]

The following command can be used to find out which process is listening on a particular port: netstat -ltnp | grep -w ':8011' How can we do the opposite, find the port number according to PID ...
yael's user avatar
  • 12.7k
0 votes
0 answers
441 views

get data from socket on port

I have a specific service that sends data on port 5555. I need to open socket on shell unix to listen on this port and print output on shell. Service is deployed as docker container. So, I run ...
init's user avatar
  • 31
0 votes
0 answers
17 views

network services reachability troubleshooting

I have voyage linux on a system. It is running an apache server and an sshd. For some reason, i cannot connect to those services from another machine. There are no error logs that i have been able to ...
atapaka's user avatar
  • 501
2 votes
1 answer
568 views

How to find a process by network domain it requests?

I noticed my Linux machine makes many DNS queries for a specific domain (subdomain) malicious.foo.bar How can I find out which application or process tries to resolve this domain? I also want to see ...
Łukasz D. Tulikowski's user avatar
0 votes
1 answer
801 views

Can two servers bind the same port?

I was surprised to discover that two servers I'm maintaining are both able to listen on port 3000 in development at the same time. With the first server running, netstat shows ▶ sudo netstat -nap ...
Pathogen's user avatar
  • 103
0 votes
1 answer
169 views

Sorting lines based on certain digit pattern

Assume I have a text file with the following lines: 192.168.1.1.55555 192.168.1.1.55555 192.168.1.1.5555 192.168.1.1.555 192.168.1.1.55 192.168.1.1.55 192.168.1.1.5 8.8.8.8.4433 8.8.8.8.443 8.8.8.8....
Zarkos.Fina's user avatar
0 votes
1 answer
1k views

How to show the "syn_sent" socket state on Linux in realtime?

I want to see the state "syn_sent" of socket in realtime during the connection process ss or netstat or any command I have tried those commands, but all fail watch netstat -tnaop|grep -i syn ...
elbarna's user avatar
  • 12.1k
0 votes
1 answer
195 views

View extended stats for listening ports (using ss?)

With ss -tuiOp we can view extended stats for an outbound process, e.g.: tcp ESTAB 0 0 192.168.68.108:32862 52.86.220....
user717847's user avatar
1 vote
1 answer
231 views

Fresh Fedora 35 - what are these active internet connections doing?

To get to this point I had a Fedora workstation 34 install- iso about a week old - ran update, rebooted, click Install Fedora 35 as it was on offer from gnome Software. Hadn't even opened Firefox yet. ...
bluesquare's user avatar
2 votes
1 answer
734 views

Which interface does a specific IP address will get routed over?

Is there a way to determine which netdev or IP link interface that a given IP address will route over … in bash/shell language? This is not about what an IP address is, given a network device name. ...
John Greene's user avatar
1 vote
1 answer
437 views

rhel + any best practice to minimize the CLOSE_WAIT sessions from linux side

when we perform the following cli on our rhel machine we get more then 600 CLOSE_WAIT lines lsof -i tcp:8088 | grep CLOSE_WAIT java 31100 yarn 385u IPv4 208022048 0t0 TCP master02.hgti.com:...
yael's user avatar
  • 12.7k
0 votes
1 answer
332 views

how to know what the process that connected to my machine VIA specific port

with the following command I want to get which are the IP's that connected on my machine with port 8088 18.23.292.9 is machine that resource manager service is running on with port 8088 ss -tanp | ...
yael's user avatar
  • 12.7k
1 vote
1 answer
1k views

netstat cannot find opened port by iptables

My Linux command is following: iptables -I INPUT -p tcp --dport 5002 -j ACCEPT iptables-save netstat -natp but the result of netstat has no item about 5002.
GallopingRooster's user avatar
2 votes
1 answer
427 views

iproute2 ss - not showing process/pid information if user is not the same user as listening process?

Is it normal behavior, or a bug, that when I run ss -nltp, I only see the process/pid information if the user I am running ss -nltp as is the same user as the listening process? $ docker run -it --rm ...
rmf's user avatar
  • 133
0 votes
1 answer
773 views

Random SSH Agent Generates on Boot in tmp Directory Even with Networking Disabled

On a recently installed Debian system I noticed that every boot, even with no networking, a folder and empty socket file are generated in /tmp/ssh-(random_letters)/agent.xxx. On every boot the random ...
emptysocket's user avatar
1 vote
2 answers
153 views

How I can grep data with some spaces and ignoring block?

I am trying to retrieve Local Address-port with port number in different block used by each IP-address in Foreign Address and PID/Program name) from the following and store it in a file: I used: ...
Tech Parinda's user avatar
4 votes
1 answer
1k views

How to find applications/ports that do bind() but don't do listen()?

When a faulty application calls bind() with a TCP socket to a port P but does not follow with listen(), the port P is not listed among open ports, i.e. netstat or ss or ls /proc/net/tcp do not show it,...
volferine's user avatar
  • 143
0 votes
1 answer
2k views

How can I get CentOS to correctly list open ports?

I am working with CentOS 7 OS hosting a set of docker containers. By using a web browser I can reach a service on port 80 and I get back a response. A bit of local knowledge helps me understand that ...
Tony Sepia's user avatar
1 vote
1 answer
800 views

netstat -lnp outputing results without PID

After using netstat -lnp I wonder how comes some of the result don't show any PID/Program name? Should I be worried? See below: Active Internet connections (only servers) Proto Recv-Q Send-Q Local ...
Antonin GAVREL's user avatar
0 votes
0 answers
166 views

How can I find out which processes are using my ports? Weird netstat output [duplicate]

I am trying to start a server that listens on 8080, but getting an error that the port is already in use. I am not running anything using that port. Running netstat -ano -p tcp | grep tcp6 shows ...
Joram's user avatar
  • 1
-1 votes
3 answers
161 views

Can anyone get the default ip using only netstat -rn, while, read, and cut command?

As you can imagine, I should only use these commands to get the default IP of my virtual machine. netstat -rn gives the following output Kernel IP routing table Destination Gateway Genmask ......
OneMoreGamble's user avatar
3 votes
1 answer
11k views

What does address 224.0.0.251:5353 represent?

I read some tutorials,they say that netstat is deprecated. I tried ss command. THis is the output Netid State Recv-Q Send-Q Local Address:Port ...
TrajcheS's user avatar
1 vote
0 answers
729 views

socket statistics (ss) program weird ipv6 listening socket address format

I have two services listening on TCP/IPv6 sockets, ssh and mysql. ss shows this: $ ss -tl6 State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 ...
spinkus's user avatar
  • 481
1 vote
0 answers
2k views

How does netstat find ESTABLISHED connections

If I perform an operation that establishes a TCP connection (e.g., an HTTP connection), the first thing that happens is that the 3-step TCP handshake is made. If I then use netstat, it shows me that ...
Stefan Vahlgren's user avatar
0 votes
1 answer
236 views

loop using grep and adding to file

I am trying to loop a netstat and grep the results by some values, and then if they match- add them to a file, but it doesnt do a grep, but just adds the whole file: #!/bin/bash while true do sudo ...
Stan's user avatar
  • 101
0 votes
1 answer
175 views

Netstat doesn't show URLs while streaming from Youtube

Learning about networks and trying to make sense of netstat output. This is the main confusion: When I run the command, there are no known URLs. For example, I'm listening a Youtube streaming and was ...
Minsky's user avatar
  • 164
0 votes
1 answer
136 views

Netstat Killing Bash Process [duplicate]

I have a bit of bash script like this: echo "Number of Connections: " Conns=$(netstat -an | grep -c ‘8800.*OK’) echo "Done" It appears to stop processing after netstat. The ...
solarflare's user avatar

1
2 3 4 5 6