Questions tagged [netstat]

analysis tool for statistics about active connections, open sockets, routing tables; in general the networking subsystem.

Filter by
Sorted by
Tagged with
0 votes
0 answers
8 views

network services reachability troubleshooting

I have voyage linux on a system. It is running an apache server and an sshd. For some reason, i cannot connect to those services from another machine. There are no error logs that i have been able to ...
user avatar
  • 441
1 vote
1 answer
46 views

How to find a process by network domain it requests?

I noticed my Linux machine makes many DNS queries for a specific domain (subdomain) malicious.foo.bar How can I find out which application or process tries to resolve this domain? I also want to see ...
user avatar
0 votes
1 answer
48 views

Can two servers bind the same port?

I was surprised to discover that two servers I'm maintaining are both able to listen on port 3000 in development at the same time. With the first server running, netstat shows ▶ sudo netstat -nap ...
user avatar
  • 103
0 votes
0 answers
31 views

NFS: how can i make nlockmgr relinquish a port

I was running Nfs-server on a rhel7.8 machine. Now the NFS server has been stopped but a Port 35191 is listening on the server, verified it using netstat and telnet. I tried various ways to find the ...
user avatar
  • 1
0 votes
1 answer
65 views

Sorting lines based on certain digit pattern

Assume I have a text file with the following lines: 192.168.1.1.55555 192.168.1.1.55555 192.168.1.1.5555 192.168.1.1.555 192.168.1.1.55 192.168.1.1.55 192.168.1.1.5 8.8.8.8.4433 8.8.8.8.443 8.8.8.8....
user avatar
0 votes
1 answer
74 views

How to show the "syn_sent" socket state on Linux in realtime?

I want to see the state "syn_sent" of socket in realtime during the connection process ss or netstat or any command I have tried those commands, but all fail watch netstat -tnaop|grep -i syn ...
user avatar
  • 10.9k
0 votes
1 answer
39 views

View extended stats for listening ports (using ss?)

With ss -tuiOp we can view extended stats for an outbound process, e.g.: tcp ESTAB 0 0 192.168.68.108:32862 52.86.220....
user avatar
1 vote
1 answer
163 views

Fresh Fedora 35 - what are these active internet connections doing?

To get to this point I had a Fedora workstation 34 install- iso about a week old - ran update, rebooted, click Install Fedora 35 as it was on offer from gnome Software. Hadn't even opened Firefox yet. ...
user avatar
0 votes
1 answer
56 views

Which interface does a specific IP address will get routed over?

Is there a way to determine which netdev or IP link interface that a given IP address will route over … in bash/shell language? This is not about what an IP address is, given a network device name. ...
user avatar
1 vote
1 answer
145 views

rhel + any best practice to minimize the CLOSE_WAIT sessions from linux side

when we perform the following cli on our rhel machine we get more then 600 CLOSE_WAIT lines lsof -i tcp:8088 | grep CLOSE_WAIT java 31100 yarn 385u IPv4 208022048 0t0 TCP master02.hgti.com:...
user avatar
  • 10.9k
0 votes
1 answer
85 views

how to know what the process that connected to my machine VIA specific port

with the following command I want to get which are the IP's that connected on my machine with port 8088 18.23.292.9 is machine that resource manager service is running on with port 8088 ss -tanp | ...
user avatar
  • 10.9k
0 votes
1 answer
174 views

netstat cannot find opened port by iptables

My Linux command is following: iptables -I INPUT -p tcp --dport 5002 -j ACCEPT iptables-save netstat -natp but the result of netstat has no item about 5002.
user avatar
1 vote
1 answer
61 views

iproute2 ss - not showing process/pid information if user is not the same user as listening process?

Is it normal behavior, or a bug, that when I run ss -nltp, I only see the process/pid information if the user I am running ss -nltp as is the same user as the listening process? $ docker run -it --rm ...
user avatar
  • 23
0 votes
1 answer
179 views

Random SSH Agent Generates on Boot in tmp Directory Even with Networking Disabled

On a recently installed Debian system I noticed that every boot, even with no networking, a folder and empty socket file are generated in /tmp/ssh-(random_letters)/agent.xxx. On every boot the random ...
user avatar
1 vote
2 answers
126 views

How I can grep data with some spaces and ignoring block?

I am trying to retrieve Local Address-port with port number in different block used by each IP-address in Foreign Address and PID/Program name) from the following and store it in a file: I used: ...
user avatar
3 votes
1 answer
279 views

How to find applications/ports that do bind() but don't do listen()?

When a faulty application calls bind() with a TCP socket to a port P but does not follow with listen(), the port P is not listed among open ports, i.e. netstat or ss or ls /proc/net/tcp do not show it,...
user avatar
  • 133
0 votes
1 answer
455 views

How can I get CentOS to correctly list open ports?

I am working with CentOS 7 OS hosting a set of docker containers. By using a web browser I can reach a service on port 80 and I get back a response. A bit of local knowledge helps me understand that ...
user avatar
1 vote
1 answer
123 views

netstat -lnp outputing results without PID

After using netstat -lnp I wonder how comes some of the result don't show any PID/Program name? Should I be worried? See below: Active Internet connections (only servers) Proto Recv-Q Send-Q Local ...
user avatar
0 votes
0 answers
165 views

How can I find out which processes are using my ports? Weird netstat output [duplicate]

I am trying to start a server that listens on 8080, but getting an error that the port is already in use. I am not running anything using that port. Running netstat -ano -p tcp | grep tcp6 shows ...
user avatar
  • 1
-1 votes
3 answers
74 views

Can anyone get the default ip using only netstat -rn, while, read, and cut command?

As you can imagine, I should only use these commands to get the default IP of my virtual machine. netstat -rn gives the following output Kernel IP routing table Destination Gateway Genmask ......
user avatar
1 vote
1 answer
2k views

What does address 224.0.0.251:5353 represent?

I read some tutorials,they say that netstat is deprecated. I tried ss command. THis is the output Netid State Recv-Q Send-Q Local Address:Port ...
user avatar
1 vote
0 answers
247 views

socket statistics (ss) program weird ipv6 listening socket address format

I have two services listening on TCP/IPv6 sockets, ssh and mysql. ss shows this: $ ss -tl6 State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 ...
user avatar
  • 357
1 vote
0 answers
859 views

How does netstat find ESTABLISHED connections

If I perform an operation that establishes a TCP connection (e.g., an HTTP connection), the first thing that happens is that the 3-step TCP handshake is made. If I then use netstat, it shows me that ...
user avatar
0 votes
1 answer
104 views

loop using grep and adding to file

I am trying to loop a netstat and grep the results by some values, and then if they match- add them to a file, but it doesnt do a grep, but just adds the whole file: #!/bin/bash while true do sudo ...
user avatar
  • 101
0 votes
1 answer
74 views

Netstat doesn't show URLs while streaming from Youtube

Learning about networks and trying to make sense of netstat output. This is the main confusion: When I run the command, there are no known URLs. For example, I'm listening a Youtube streaming and was ...
user avatar
  • 164
0 votes
1 answer
63 views

Netstat Killing Bash Process [duplicate]

I have a bit of bash script like this: echo "Number of Connections: " Conns=$(netstat -an | grep -c ‘8800.*OK’) echo "Done" It appears to stop processing after netstat. The ...
user avatar
0 votes
1 answer
448 views

What is the modern equivalent to netstat -peanut

I heavily rely on viewing output of netstat as in sudo netstat -peanut Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State ...
user avatar
-1 votes
1 answer
1k views

Port 3000 is always being hogged by grafana-server

I need port 3000 free for my dev work. But it's being used by grafana-server, that I don't remember ever installing. We do use it within our company so perhaps at some point it has been added to ...
user avatar
  • 43
1 vote
0 answers
419 views

ss showing socket stuck in SYN-SENT with no traceable PID

On a client I see the following: [root@redacted_local ~]# ss | grep -i syn SYN-SENT 0 1 redacted_local_ip:792 redacted_server_ip:nfs ...
user avatar
  • 1,490
-1 votes
1 answer
66 views

what are the options to close manual the port correctly or release the port on rhel machines?

we have redhat 7.5 server we are suspect that port 50070 not closed correctly by the service , ( we check by netstat and PID not found ) but from the log we can see that port is in use so we try to do ...
user avatar
  • 10.9k
-2 votes
1 answer
420 views

linux + port in use + but no PID return from netstat to kill the PID

we have Hadoop cluster - the linux are rhel 7.5 machines and namenode is using the port 50070 we can see from the log that port 50070 is in use but the interesting thing is that when we do netstat -...
user avatar
  • 10.9k
1 vote
1 answer
696 views

Configure static routing for the virbr0 using local interface as next hop

Having the following topology: hostA(virbr0: 192.168.122.1) -- TAP interface -- (eth0: 192.168.122.85) gw (eth1: 192.168.3.51) --- (LAN: 192.168.3.0/24) gw : QEMU VM Guest, that is acting as a gateway ...
user avatar
0 votes
2 answers
145 views

Does netstat -l include anything that netstat -a does not have?

I am using Ubuntu 16.04, but I believe my question applies to many distros, such as Debian, CentOS, and Red Hat. The manpage for netstat -l is: Show only listening sockets. (These are omitted by ...
user avatar
1 vote
2 answers
502 views

How can I confirm which process is connect to remote port?

My loacl server IP is 192.168.122.100, and remote server IP is 192.168.122.50. I need to kill all processes which connect to 192.168.122.50:56666. By executing ss comand, I found there are three TCP ...
user avatar
  • 353
1 vote
2 answers
1k views

'ss' shows multiple listening pids for same port

We have sh scripts using 'netstat' in our production code. We use command 'netstat -lntup' to retrieve all the pids which are listening to some port. I replaced the command with 'ss -lntup. Now, for ...
user avatar
  • 123
0 votes
1 answer
209 views

How do I parse information from netstat?

How do I extract the following from the output of netstat -anp? remove ip address remote port local application name local port PID I need this information to run in my conky. It shows everything, ...
user avatar
4 votes
2 answers
2k views

What is the alternative of netstat in linux? [duplicate]

'netstat' is deprecated for Linux os. So I am looking for the right alternative of the 'netstat', So what will be right alternative for netstat? I found out one 'SS' command but it is not sufficient ...
user avatar
1 vote
0 answers
230 views

How to monitor a UDP specific port/socket?

I have an application that receives UDP packets at port 5000. In order to be 100% sure that the application is receiving all packets (for example the RX buffer could be full and some packets could be ...
user avatar
  • 569
0 votes
1 answer
1k views

what does mean 0.0.0.0:22 under the column local address of netstat command?

Under the column "local address" of netstat: 0.0.0.0:22 means that access to port 22 is allowed from any ip addresses. which ip addresses? ip addresses within my local network or outside my local ...
user avatar
  • 3
1 vote
1 answer
264 views

How to block a service (xrdp) from using a specific port?

I'm admin for some devs and they requested that a port on a machine be clear for a specific purpose. When one of the devs went to use that port, it was in use. An netstat -p showed that xrdp/Xnvc was ...
user avatar
  • 379
0 votes
1 answer
56 views

Running netstat on 2 servers checking connections to the other one shows mismatch in number of connections

If I check how many connections serverA (192.168.1.1) has open to serverB (192.168.2.1), I get the following response: [username@serverA ~] $ netstat -n | grep 192.168.2.1 tcp 0 0 192.168....
user avatar
  • 168
0 votes
2 answers
1k views

Closing a port listening on a local host

How do i close a port listening on a local host in CentOS7? So far I have used the below command to find the process id sudo netstat -tlpn | grep 5601 Then, used the below command to kill the ...
user avatar
0 votes
0 answers
46 views

The output of netstat -an show several lines twice

Why the output of "netstat -an" shows several lines twice (48035 and 48036)? netstan -an udp 0 0 0.0.0.0:48120 0.0.0.0:* udp 0 0 0.0.0.0:...
user avatar
  • 103
1 vote
1 answer
309 views

How to not show localhost in ss output?

When I type ss -atur I get lots of connections, but most are destined for localhost and I don't really care about those. How can I filter the output to not show connections with destination localhost?...
user avatar
  • 674
0 votes
0 answers
54 views

Is there a way to increase the 'Foreign Address' Field in 'netstat -tup'

OK, my question is completely in the title. Is there a way to increase the 'Foreign Address' Field in 'netstat -tup' ? (for those who never used -tup, it is the same like -tupn but resolving the ...
user avatar
3 votes
1 answer
1k views

What is this : ^[3;J^[H^[2J?

I am on a Debian system fresh installed, logged in via ssh on /dev/pts/0, and have entered the following command watch -n 10 clear > /dev/pts/0 ; netstat -tupn 2>/dev/null | grep -v 3306 > /...
user avatar
0 votes
1 answer
32 views

is it possible to check the time that l application start to using port and established

From the following netsta we can see that Air_metal application is using port 50070 and established # netstat -anp | grep :50070 | grep ESTABLISHED tcp6 0 0 100.14.74.11:48148 100.14....
user avatar
  • 10.9k
0 votes
1 answer
189 views

AIX netstat -a proto column

Greetings everyone, I am looking at the output of the "netstat -an" output on an AIX 7 server and the proto column has confused me a little bit. First, the output: Active Internet connections (...
user avatar
  • 1
0 votes
1 answer
461 views

Many Send-Q have packets TCP connections, is this abnormality? what caused this?

The 125.193.242.25 is a CDN node, and when I analyze the TCP connect, there shows below information: [root@hkk10 ~]# netstat -na Active Internet connections (servers and established) Proto Recv-Q ...
user avatar
  • 455
2 votes
0 answers
155 views

ss is slow when process option (-p) used

When checking for process listening on port using ss command, it's slow when compared with (obsolete) netstat command. $ time ss -nlp | grep -E ':8081|:8007|:8010' LISTEN 0 100 ...
user avatar
  • 124

1
2 3 4 5