Questions tagged [netstat]
analysis tool for statistics about active connections, open sockets, routing tables; in general the networking subsystem.
5
votes
0answers
165 views
What network connections are not seen by netstat/lsof/ss?
Network monitoring tools ss, lsof -i, netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with ip we can see other ...
0
votes
1answer
17 views
app.asar --nod ? What programme is it (in my netstat statistics?
What is app.asar --nod?
jerzy@jerzy:~$ sudo netstat -tupln
[sudo] password for jerzy:
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program ...
1
vote
0answers
51 views
What does the inode column in netstat signify?
Issuing the command, netstat -pulet, there is an inode column that appears, and so issuing a find command I found that it links to inodes in the /sys/kernel/slab/cgroup/<...> section.
For ...
0
votes
0answers
119 views
netstat command for popular IP addresses OK in CentOS 6, fails in CentOS 7
In CentOS 6 w/ OpenVZ 2.6.32, this command outputs IPs with the highest number of connections against port 22, e.g:
[root@legovz ~]# netstat -antu | grep :22 | grep -v LISTEN | awk '{print $5}' | cut ...
1
vote
1answer
62 views
Why does postgresql server have a `localhost:57504` to `localhost:57504` UDP “connection”?
$ sudo netstat -ap | grep postg
tcp 0 0 localhost:postgresql 0.0.0.0:* LISTEN 1567/postgres
udp 0 0 localhost:57504 localhost:57504 ...
-3
votes
1answer
80 views
What do `0.0.0.0:*`, `[::]:mysql`, and `[::]:*` mean in netstat output?
$ sudo netstat -ap | grep postg
tcp 0 0 localhost:postgresql 0.0.0.0:* LISTEN 1567/postgres
udp 0 0 localhost:57504 localhost:57504 ...
0
votes
1answer
19 views
Does `netstat` output different sockets with and without -n?
man netstat says
--numeric, -n
Show numerical addresses instead of trying to determine symbolic host,
port or user names.
Does netstat output additional sockets with -n than without -n?
Or ...
1
vote
0answers
15 views
System statistics from different utilities don't agree
I am running an Aliyun instance with 8 vCPUs to do some high performance computing, so I want to make full use of the machine. In other words, extremely high CPU usage is not a problem; instead it is ...
0
votes
2answers
80 views
How can I find the mapping on `$DISPLAY` after `ssh -X`?
On machine B, I remote access machine C
$ ssh -X t@C
$ echo $DISPLAY
localhost:10.0
How can I find/verify the mapping of $DISPLAY on C to $DISPLAY on B? Can it be done by the following command ...
1
vote
1answer
40 views
confused by netstat result
I ssh to my ubuntu server and run sudo netstat -a -p and I get this:
tcp 0 0 ip-172-31-25-123.us:ssh mailDOTjjtoursDOTcom:54531 ESTABLISHED 1516/sshd: ubuntu [
And when I use my other ...
2
votes
1answer
49 views
Red Hat Linux - port is in listening state but could not find process ID
I have this problem for my application, port is in listening state but process ID is not showing up. Used below commands. This is cloud AWS server Red Hat Linux.
$ netstat -tulpn
tcp 0 ...
0
votes
0answers
18 views
Question on Netstat output “app --node-in” & other
While doing "netstat -p", I got result out of which, I am unable to understand below output:-
unix 3 [ ] STREAM CONNECTED 3889891 23976/app --node-in
unix 3 [ ] STREAM CONNECTED 33223 ...
0
votes
2answers
106 views
How can I verify that the port forwarding is established by checking the sockets?
After I run
$ ssh -L 9000:google.com:80 testme@localhost
how can I verify that the port forwarding is established by checking the sockets (internet and unix domain sockets)?
Thanks.
0
votes
0answers
257 views
Tcp TCPBacklogDrop and packets pruned from receive queue
I am analyzing two virtual machines in the same LAN, tcp packet loss problem, but the knowledge has been exhausted.
platform
CentOS Linux release 7.2.1511 (Core)
3.10.0-327.el7.x86_64 #1 SMP Thu Nov ...
2
votes
1answer
420 views
reading TCP connection list from /proc
I'm trying to implement code that enumerate all existing TCP connections per process (similar to netstat -lptn).
I prefer to implement it myself and not to rely on netstat.
In order to do that, I'm ...
0
votes
1answer
61 views
Process appear by “netstat” but doesn't appear by “ps -a”
I have a machine in my organization that I sshed and received a terminal.
When I run netstat -ntlp I received:
[root@webtl1 ~]# netstat -ntlp
Active Internet connections (only servers)
Proto ...
1
vote
2answers
100 views
What is the server-client relationship between a terminal emulator, a window manager and a X server processes?
In APUE (see the figure below), how do a terminal emulator process and a window manager
(e.g. openbox) process communicate? Is a temrinal emulator process
a client of a window manager process, based ...
-2
votes
1answer
73 views
Is a terminal emulator process a server? [duplicate]
Is a temrinal emulator process a server?
If yes, what is its client(s)? How can I find out its client(s)? Thanks.
netstat output contains lxterminal processes. Does that mean that
a terminal ...
2
votes
1answer
73 views
Why doesn't `netstat` show Screen client but only Screen server process?
From https://unix.stackexchange.com/a/485290/674
Further down in the netstat output is UNIX sockets:
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State ...
0
votes
2answers
34 views
How can I find out the Screen server process?
Does GNU Screen have a server-client architecture model?
Is each Screen session a Screen client process?
Why can't I find out the Screen server process, but only its session processes i.e. ...
0
votes
0answers
195 views
Whose `I-Node` does `netstat -ap` for unix domain sockets refer to?
What does I-Node mean in the output of netstat -ap for unix domain sockets?
It seems not the same as the inode of the socket file:
$ netstat -ap
...
Active UNIX domain sockets (servers and ...
0
votes
1answer
90 views
How to close nc port in Debian 9?
I am struggling to close these ports which seem to be backdoors -- or at least I have never opened and used them. How can I close or shutdown nc and close these ports?
netstat -lntup | grep nc
ps-...
-1
votes
1answer
72 views
Why does atop open a raw socket?
I install atop on Debian 9. It runs as a monitoring daemon.
Why is it listening on a raw socket? Raw sockets are used to generate arbitrary IPv4 packets or capture all packets read all packets for ...
0
votes
1answer
346 views
ss shows a raw socket. What does it mean that it is listening on “*:ipproto-255”?
What does ss mean by *:ipproto-255, in the local address/port column?
$ sudo ss -ap | grep -vE "^(nl |u_)"
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
p_raw UNCONN 0 ...
0
votes
0answers
67 views
Performance of active port - netstat
Below command
[root@machine1 output]# netstat -s --udp
IcmpMsg:
InType0: 371137
InType3: 296
InType8: 386843
InType11: 4
InType13: 141
InType15:...
1
vote
0answers
228 views
netstat show a listen port but pid don't exist and can't find it with lsof
I am running macOS(0.13.6) and while trying to test tinc, I get a warning that port 0.0.0.0:655 is already in use.
This is the output I get from netstat:
$ sudo netstat -anv -p udp
Active Internet ...
0
votes
1answer
68 views
Monitor Nextcloud connections with netstat
I'm not able to detect incoming connections from Nextcloud sync clients via netstat on my server.
I have a server in my LAN, running Nextcloud with MySQL in docker containers. I use multiple ...
2
votes
2answers
67 views
Using a if/else statement in shell for netsat
My goal is to ensure that email connections are limited to outbound only
So I have two shell commands one is
netstat -an | grep ':25' | grep -v '127.0.0.1' | wc -l
which prints out 1
The command ...
1
vote
1answer
41 views
How to check which interface(s) a service is bound to?
netstat and similar commands provide information on services bound to an IP. This information is however limited when a service binds to "all available interfaces":
root@srv ~# netstat -tulpn | grep ...
0
votes
2answers
109 views
Looking for clarification on netstat results
I am looking for some clarification on the following netstat results. The following results are showing 3 java processes. Is there a way to find which java programs are they referring to?
Another ...
0
votes
1answer
63 views
List TCP connections
How can I format netstat output so I have a list of TCP connections made to the server?
A bit like this:
192.168.234.1 51780
192.168.234.221 51444
192.168.234.251 51447
The closest I got was six ...
0
votes
1answer
222 views
Two local address listening on same port?
How is it possible that netstat -a | grep 8081 shows this:
localhost.8081 *.* 0 0 49152 0 LISTEN
*.8081 *.* 0 0 49152 ...
1
vote
1answer
95 views
Significance of output of netstat -i command in AIX
The output of the netstat-i command on AIX 7.1 / AIX 7.2 :
Name Mtu Network Address Ipkts Ierrs Opkts Oerrs Coll
en0 65390 link#2 e2.f9.3a.a8.fc.2 1205 0 71 ...
1
vote
2answers
3k views
Is there documentation for /proc/net/netstat and /proc/net/snmp?
There is a long list of stats in /proc/net/netstat and /proc/net/snmp, both of which I think come from the net-tools project. Is there any official or unofficial documentation about these fields? Or ...
1
vote
1answer
177 views
Difference of interfaces in netstat -i and netstat -i 1 1 command
Result of the netstat -i command in Solaris:
# netstat -i
Name Mtu Net/Dest Address Ipkts Ierrs Opkts Oerrs Collis Queue
lo0 8232 loopback localhost 179 0 179 0 ...
0
votes
1answer
311 views
Are the 'Local Address' and 'Remote Address' netstat columns symmetrical for localhost?
If I have the following netstat output:
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:3306 127.0.0.1:21950 ...
0
votes
1answer
6k views
How to figure out the meaning behind Recv-Q and Send-Q from netstat?
netstat -ntp
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 8216172 0 127.0.0.1:9503 ...
3
votes
2answers
860 views
Incoming and outgoing traffic when NOTHING is running
In a system with nothing running (at least nothing I know of). Listening of incoming and outgoing traffic prints this output:
192.168.1.1 => all-systems.mcast.net 0b ...
3
votes
1answer
410 views
--numeric-ports option for netstat
$ netstat --version
net-tools 1.60
netstat 1.42 (2001-04-15)
Fred Baumgarten, Alan Cox, Bernd Eckenfels, Phil Blundell, Tuan Hoang and others
+NEW_ADDRT +RTF_IRTT +RTF_REJECT +FW_MASQUERADE +I18N
AF: (...
1
vote
2answers
76 views
Capture internet traffic on single interface
I have been asked by a customer to provide a list of all URL's that my company's linux server connects to in order to complete a software update including individual TCP,UDP ports that these ...
1
vote
0answers
84 views
Show bound socket (but not listen) process
I am trying to understand how bind() works.
I open a socket, and bind it to port 5001, but I don't execute listen() on it:
sockfd = socket(AF_INET, SOCK_STREAM, 0);
/* Initialize socket structure */
...
0
votes
1answer
66 views
Open connections with unresolvable domain
Output of sudo watch lsof -i and sudo watch netstat -tp show ESTABLISHED connections with unresolvable domain (e.g., host, dig woldn't resolve, trying to access domain directly via URL from firefox ...
0
votes
1answer
594 views
sudo netstat -antp not showing PID
i am testing stuff with sockets and i encountered that strange case :
i coded i very simple tcp server in c, i made it block after accept(), just to see what happen when accepting multiple connection ...
0
votes
1answer
573 views
Why do RX-OK and TX-OK increase
I'm testing my linux server with the command netstat -i.
I just want to know what enp2s0f0 means. Each time that I execute netstat -i, its RX-OK and TX-OK always increase. What does this mean?
1
vote
1answer
93 views
Confused about the “-a” switch of netstat on mac os
The -a switch documentation says the following:
-a With the default display, show the state of all sockets; normally sockets used by server processes
are not shown. With the routing ...
2
votes
2answers
194 views
find pid of open tcp port, as a regular user
From local host I'm ssh tunneling some remote host:port to my local host:port, so anybody on a remote host can use their "local" port to access my port via that tunnel.
I'm using some regular (non-...
0
votes
2answers
2k views
Killed process blocks TCP ports
I've had this issue on several machines. Is there some way to free this blocked port? Here is an example:
Let me explain. I've killed some JAVA-Process on SUSE Linux Enterprise Server 11 SP4, which ...
0
votes
1answer
893 views
Netstat doesn't show my machine IP as listening on port 22
I am able to ssh to the machine.
But my machine not shown as listening on port 22.
Below is what I see.
It show as listening on port 53, 21, 8080, 8443 etc. But no entry for 22(ssh).
My machine IP is ...
2
votes
0answers
270 views
Getting incomplete output in netstat
Apache tomcat is running on port 8080, but netstat -tlnp does not show it, instead its output gets truncated with a binary character:
# netstat -tlnp
Active Internet connections (only servers)
Proto ...
2
votes
3answers
149 views
script to verify running services on specific ports
I got a task to do.
I have to search whether, are there running services on below ports.
ports 53 & 55
If not I have to send alerts.
Please correct my logic and syntax in below code for one port
...
