Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [netstat]

analysis tool for statistics about active connections, open sockets, routing tables; in general the networking subsystem.

5
votes
0answers
165 views

What network connections are not seen by netstat/lsof/ss?

Network monitoring tools ss, lsof -i, netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with ip we can see other ...
0
votes
1answer
17 views

app.asar --nod ? What programme is it (in my netstat statistics?

What is app.asar --nod? jerzy@jerzy:~$ sudo netstat -tupln [sudo] password for jerzy: Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program ...
1
vote
0answers
51 views

What does the inode column in netstat signify?

Issuing the command, netstat -pulet, there is an inode column that appears, and so issuing a find command I found that it links to inodes in the /sys/kernel/slab/cgroup/<...> section. For ...
0
votes
0answers
119 views

netstat command for popular IP addresses OK in CentOS 6, fails in CentOS 7

In CentOS 6 w/ OpenVZ 2.6.32, this command outputs IPs with the highest number of connections against port 22, e.g: [root@legovz ~]# netstat -antu | grep :22 | grep -v LISTEN | awk '{print $5}' | cut ...
1
vote
1answer
62 views

Why does postgresql server have a `localhost:57504` to `localhost:57504` UDP “connection”?

$ sudo netstat -ap | grep postg tcp 0 0 localhost:postgresql 0.0.0.0:* LISTEN 1567/postgres udp 0 0 localhost:57504 localhost:57504 ...
-3
votes
1answer
80 views

What do `0.0.0.0:*`, `[::]:mysql`, and `[::]:*` mean in netstat output?

$ sudo netstat -ap | grep postg tcp 0 0 localhost:postgresql 0.0.0.0:* LISTEN 1567/postgres udp 0 0 localhost:57504 localhost:57504 ...
0
votes
1answer
19 views

Does `netstat` output different sockets with and without -n?

man netstat says --numeric, -n Show numerical addresses instead of trying to determine symbolic host, port or user names. Does netstat output additional sockets with -n than without -n? Or ...
1
vote
0answers
15 views

System statistics from different utilities don't agree

I am running an Aliyun instance with 8 vCPUs to do some high performance computing, so I want to make full use of the machine. In other words, extremely high CPU usage is not a problem; instead it is ...
0
votes
2answers
80 views

How can I find the mapping on `$DISPLAY` after `ssh -X`?

On machine B, I remote access machine C $ ssh -X t@C $ echo $DISPLAY localhost:10.0 How can I find/verify the mapping of $DISPLAY on C to $DISPLAY on B? Can it be done by the following command ...
1
vote
1answer
40 views

confused by netstat result

I ssh to my ubuntu server and run sudo netstat -a -p and I get this: tcp 0 0 ip-172-31-25-123.us:ssh mailDOTjjtoursDOTcom:54531 ESTABLISHED 1516/sshd: ubuntu [ And when I use my other ...
2
votes
1answer
49 views

Red Hat Linux - port is in listening state but could not find process ID

I have this problem for my application, port is in listening state but process ID is not showing up. Used below commands. This is cloud AWS server Red Hat Linux. $ netstat -tulpn tcp 0 ...
0
votes
0answers
18 views

Question on Netstat output “app --node-in” & other

While doing "netstat -p", I got result out of which, I am unable to understand below output:- unix 3 [ ] STREAM CONNECTED 3889891 23976/app --node-in unix 3 [ ] STREAM CONNECTED 33223 ...
0
votes
2answers
106 views

How can I verify that the port forwarding is established by checking the sockets?

After I run $ ssh -L 9000:google.com:80 testme@localhost how can I verify that the port forwarding is established by checking the sockets (internet and unix domain sockets)? Thanks.
0
votes
0answers
257 views

Tcp TCPBacklogDrop and packets pruned from receive queue

I am analyzing two virtual machines in the same LAN, tcp packet loss problem, but the knowledge has been exhausted. platform CentOS Linux release 7.2.1511 (Core) 3.10.0-327.el7.x86_64 #1 SMP Thu Nov ...
2
votes
1answer
420 views

reading TCP connection list from /proc

I'm trying to implement code that enumerate all existing TCP connections per process (similar to netstat -lptn). I prefer to implement it myself and not to rely on netstat. In order to do that, I'm ...
0
votes
1answer
61 views

Process appear by “netstat” but doesn't appear by “ps -a”

I have a machine in my organization that I sshed and received a terminal. When I run netstat -ntlp I received: [root@webtl1 ~]# netstat -ntlp Active Internet connections (only servers) Proto ...
1
vote
2answers
100 views

What is the server-client relationship between a terminal emulator, a window manager and a X server processes?

In APUE (see the figure below), how do a terminal emulator process and a window manager (e.g. openbox) process communicate? Is a temrinal emulator process a client of a window manager process, based ...
-2
votes
1answer
73 views

Is a terminal emulator process a server? [duplicate]

Is a temrinal emulator process a server? If yes, what is its client(s)? How can I find out its client(s)? Thanks. netstat output contains lxterminal processes. Does that mean that a terminal ...
2
votes
1answer
73 views

Why doesn't `netstat` show Screen client but only Screen server process?

From https://unix.stackexchange.com/a/485290/674 Further down in the netstat output is UNIX sockets: Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State ...
0
votes
2answers
34 views

How can I find out the Screen server process?

Does GNU Screen have a server-client architecture model? Is each Screen session a Screen client process? Why can't I find out the Screen server process, but only its session processes i.e. ...
0
votes
0answers
195 views

Whose `I-Node` does `netstat -ap` for unix domain sockets refer to?

What does I-Node mean in the output of netstat -ap for unix domain sockets? It seems not the same as the inode of the socket file: $ netstat -ap ... Active UNIX domain sockets (servers and ...
0
votes
1answer
90 views

How to close nc port in Debian 9?

I am struggling to close these ports which seem to be backdoors -- or at least I have never opened and used them. How can I close or shutdown nc and close these ports? netstat -lntup | grep nc ps-...
-1
votes
1answer
72 views

Why does atop open a raw socket?

I install atop on Debian 9. It runs as a monitoring daemon. Why is it listening on a raw socket? Raw sockets are used to generate arbitrary IPv4 packets or capture all packets read all packets for ...
0
votes
1answer
346 views

ss shows a raw socket. What does it mean that it is listening on “*:ipproto-255”?

What does ss mean by *:ipproto-255, in the local address/port column? $ sudo ss -ap | grep -vE "^(nl |u_)" Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port p_raw UNCONN 0 ...
0
votes
0answers
67 views

Performance of active port - netstat

Below command [root@machine1 output]# netstat -s --udp IcmpMsg: InType0: 371137 InType3: 296 InType8: 386843 InType11: 4 InType13: 141 InType15:...
1
vote
0answers
228 views

netstat show a listen port but pid don't exist and can't find it with lsof

I am running macOS(0.13.6) and while trying to test tinc, I get a warning that port 0.0.0.0:655 is already in use. This is the output I get from netstat: $ sudo netstat -anv -p udp Active Internet ...
0
votes
1answer
68 views

Monitor Nextcloud connections with netstat

I'm not able to detect incoming connections from Nextcloud sync clients via netstat on my server. I have a server in my LAN, running Nextcloud with MySQL in docker containers. I use multiple ...
2
votes
2answers
67 views

Using a if/else statement in shell for netsat

My goal is to ensure that email connections are limited to outbound only So I have two shell commands one is netstat -an | grep ':25' | grep -v '127.0.0.1' | wc -l which prints out 1 The command ...
1
vote
1answer
41 views

How to check which interface(s) a service is bound to?

netstat and similar commands provide information on services bound to an IP. This information is however limited when a service binds to "all available interfaces": root@srv ~# netstat -tulpn | grep ...
0
votes
2answers
109 views

Looking for clarification on netstat results

I am looking for some clarification on the following netstat results. The following results are showing 3 java processes. Is there a way to find which java programs are they referring to? Another ...
0
votes
1answer
63 views

List TCP connections

How can I format netstat output so I have a list of TCP connections made to the server? A bit like this: 192.168.234.1 51780 192.168.234.221 51444 192.168.234.251 51447 The closest I got was six ...
0
votes
1answer
222 views

Two local address listening on same port?

How is it possible that netstat -a | grep 8081 shows this: localhost.8081 *.* 0 0 49152 0 LISTEN *.8081 *.* 0 0 49152 ...
1
vote
1answer
95 views

Significance of output of netstat -i command in AIX

The output of the netstat-i command on AIX 7.1 / AIX 7.2 : Name Mtu Network Address Ipkts Ierrs Opkts Oerrs Coll en0 65390 link#2 e2.f9.3a.a8.fc.2 1205 0 71 ...
1
vote
2answers
3k views

Is there documentation for /proc/net/netstat and /proc/net/snmp?

There is a long list of stats in /proc/net/netstat and /proc/net/snmp, both of which I think come from the net-tools project. Is there any official or unofficial documentation about these fields? Or ...
1
vote
1answer
177 views

Difference of interfaces in netstat -i and netstat -i 1 1 command

Result of the netstat -i command in Solaris: # netstat -i Name Mtu Net/Dest Address Ipkts Ierrs Opkts Oerrs Collis Queue lo0 8232 loopback localhost 179 0 179 0 ...
0
votes
1answer
311 views

Are the 'Local Address' and 'Remote Address' netstat columns symmetrical for localhost?

If I have the following netstat output: Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:3306 127.0.0.1:21950 ...
0
votes
1answer
6k views

How to figure out the meaning behind Recv-Q and Send-Q from netstat?

netstat -ntp Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 8216172 0 127.0.0.1:9503 ...
3
votes
2answers
860 views

Incoming and outgoing traffic when NOTHING is running

In a system with nothing running (at least nothing I know of). Listening of incoming and outgoing traffic prints this output: 192.168.1.1 => all-systems.mcast.net 0b ...
3
votes
1answer
410 views

--numeric-ports option for netstat

$ netstat --version net-tools 1.60 netstat 1.42 (2001-04-15) Fred Baumgarten, Alan Cox, Bernd Eckenfels, Phil Blundell, Tuan Hoang and others +NEW_ADDRT +RTF_IRTT +RTF_REJECT +FW_MASQUERADE +I18N AF: (...
1
vote
2answers
76 views

Capture internet traffic on single interface

I have been asked by a customer to provide a list of all URL's that my company's linux server connects to in order to complete a software update including individual TCP,UDP ports that these ...
1
vote
0answers
84 views

Show bound socket (but not listen) process

I am trying to understand how bind() works. I open a socket, and bind it to port 5001, but I don't execute listen() on it: sockfd = socket(AF_INET, SOCK_STREAM, 0); /* Initialize socket structure */ ...
0
votes
1answer
66 views

Open connections with unresolvable domain

Output of sudo watch lsof -i and sudo watch netstat -tp show ESTABLISHED connections with unresolvable domain (e.g., host, dig woldn't resolve, trying to access domain directly via URL from firefox ...
0
votes
1answer
594 views

sudo netstat -antp not showing PID

i am testing stuff with sockets and i encountered that strange case : i coded i very simple tcp server in c, i made it block after accept(), just to see what happen when accepting multiple connection ...
0
votes
1answer
573 views

Why do RX-OK and TX-OK increase

I'm testing my linux server with the command netstat -i. I just want to know what enp2s0f0 means. Each time that I execute netstat -i, its RX-OK and TX-OK always increase. What does this mean?
1
vote
1answer
93 views

Confused about the “-a” switch of netstat on mac os

The -a switch documentation says the following: -a With the default display, show the state of all sockets; normally sockets used by server processes are not shown. With the routing ...
2
votes
2answers
194 views

find pid of open tcp port, as a regular user

From local host I'm ssh tunneling some remote host:port to my local host:port, so anybody on a remote host can use their "local" port to access my port via that tunnel. I'm using some regular (non-...
0
votes
2answers
2k views

Killed process blocks TCP ports

I've had this issue on several machines. Is there some way to free this blocked port? Here is an example: Let me explain. I've killed some JAVA-Process on SUSE Linux Enterprise Server 11 SP4, which ...
0
votes
1answer
893 views

Netstat doesn't show my machine IP as listening on port 22

I am able to ssh to the machine. But my machine not shown as listening on port 22. Below is what I see. It show as listening on port 53, 21, 8080, 8443 etc. But no entry for 22(ssh). My machine IP is ...
2
votes
0answers
270 views

Getting incomplete output in netstat

Apache tomcat is running on port 8080, but netstat -tlnp does not show it, instead its output gets truncated with a binary character: # netstat -tlnp Active Internet connections (only servers) Proto ...
2
votes
3answers
149 views

script to verify running services on specific ports

I got a task to do. I have to search whether, are there running services on below ports. ports 53 & 55 If not I have to send alerts. Please correct my logic and syntax in below code for one port ...