Questions tagged [netstat]
analysis tool for statistics about active connections, open sockets, routing tables; in general the networking subsystem.
256
questions
0
votes
0
answers
50
views
Established but hidden TCP connection
On computer 10.196.111.161, I can see the following established tcp connection:
[10.196.111.161]# netstat -natp | grep 7000
Proto Recv-Q Send-Q Local Address Foreign Address State ...
- 101
-1
votes
0
answers
30
views
Which process communicate with Unix socket
I see process that has unix socket
PID=55
netstat -nxpl | grep 55
I see Proto=unix , State=LISTENING, Inode=1234 pid=55
I can see that Inode in /proc/net/unix
How can I know which process communicate ...
- 1
0
votes
2
answers
45
views
How netstat is able to read route tables?
For my php containers if I need to detect the ip where ide listens to. I run:
ip=$(netstat -rn | grep "^0.0.0.0 " | cut -d " " -f10)
And I get the gateway IP. But for that I need ...
- 1,021
0
votes
0
answers
13
views
Disparity between file-nr and netstat
> netstat | grep :389 | grep ESTABLISHED | wc -l
2116
> cat /proc/sys/fs/file-nr
1920 0 3178047
how can a subset of the number of tcp connections be more than the total number of file ...
- 101
1
vote
1
answer
23
views
How to list the connections of the port forwarded by firewalld?
I have forwarded a port using firewalld, and everything is functioning properly. However, the 'netstat' and 'ss' commands do not display the port opened by firewalld, nor do they show the connections. ...
- 13
0
votes
1
answer
33
views
netstat output: unexpected kind 634 which 0x27
When running the netstat -tuln command on macOS terminal I get a strange output at the bottom:
... truncated...
e85ca8f83c2f500b dgram 0 0 0 e85ca8f83c2f3fa3 0 ...
- 203
1
vote
1
answer
26
views
Linux Webserver not "Accepting" Connections
First off, thanks for any help anyone can provide, I greatly appreciate it!
I have a basic network I have set up for testing. It has pfSense acting as a Gateway/DHCP/DNS host and two Linux machines ...
- 11
0
votes
0
answers
70
views
'curl' command works intermittently
I am trying to install and configure a high availability RKE2 cluster (Rancher Kubernetes Engine 2). My architecture consists of 4 VMs: one with DNS and LoadBalancer configured, another with the ...
1
vote
1
answer
117
views
ss or ip equivalent to netstat -gn to show multicast memberships?
Is there a modern Linux tool that will show the equivalent of netstat -gn to show multicast group memberships? This old command shows output like this:
IPv6/IPv4 Group Memberships
Interface ...
- 2,432
0
votes
0
answers
24
views
Difference between wireless discarded packet metrics and netstat interface tx errors?
cat /proc/net/wireless on my system returns the following:
Inter-| sta-| Quality | Discarded packets | Missed | WE
face | tus | link level noise | nwid crypt frag retry ...
- 123
0
votes
0
answers
324
views
How to use netstat to view a list of active TCP and UDP connections and count them?
I want to monitor the number of active TCP and UDP connections using the netstat command. I tried to run the following command:
netstat -a | grep -e tcp -e udp | awk '{print $1,$6}' | sort | uniq -c
...
- 1,034
0
votes
0
answers
24
views
Find "offending" script/file cause multiple connections and hogging resources
I am using a Linux VPS running Cyberpanel/CentOS and PHP 7.4.
Using htop and netstat, I can see that there are tons of TCP connections open when my VPS server/website stops responding. I have ...
- 1
1
vote
0
answers
94
views
Why is there more `time_wait` displayed in `sockstat` than it actually is?
Why is there more time_wait displayed in /proc/net/sockstat than it actually is? And how to fix it?
[root@node09 ~]# netstat -ant | grep TIME_WAIT | wc -l
28
[root@node09 ~]# netstat -ant|awk '/^tcp/ ...
- 11
0
votes
0
answers
75
views
why netstat shows a digit as a program name for established ssh connections?
When I run netstat -antplu, I see entries like below, where a digit is shown for "Program name". These entries are related to established ssh connections. But why does it show a digit as the ...
- 101
0
votes
2
answers
61
views
why iptables commands yield seemingly contradictory results on my embeded Linux?
I'm running an Embedded Linux system, whose kernel is 3.18.21, with some applications on top it on MIPS. When I run iptables & ip6tables on the Linux, such as the following:
iptables -A INPUT -p ...
- 103
0
votes
3
answers
791
views
netstat not display open ports but I can telnet to the open port
The ports isn't being display when I run netstat
netstat -nal | grep 2237
tcping does show that the port is open
C:\Users\slee>tcping 172.29.69.250 2237
Probing 172.29.69.250:2237/tcp - Port is ...
- 481
0
votes
1
answer
958
views
Find out what process is listening on a specific port
For the first time in my life, I am unable to figure out what process is listening on a specific port in Linux :)
This is an Ubuntu Server 22.04 installation, running K8s. There is an ingress ...
- 101
0
votes
0
answers
85
views
Understanding netstat: are these TCP connections actually direct ones?
I am reading about networks, and in an example output table from netstat -n (from visiting a hypothetical website hosted from 216.40.231.195), my book shows a row that looks like this:
Proto Local ...
- 101
2
votes
0
answers
136
views
What Is The Order Of Netstat Ports Displayed?
I display the port of certain process type for an environment using netstat and the pid
netstat -pant| grep LISTEN | grep 100452
There are always 2 ports for this process type (e.g. 8107 and 8112), ...
- 309
1
vote
1
answer
109
views
CLOSE_WAIT not visible on the kubernetes node
Debugging a tcp: out of memory error, I found that a process (from a container) has a lot of connection on CLOSE_WAIT status aka 08 when I cat /proc/XXX/net/tcp
But neither netstat or ss were showing ...
- 315
1
vote
1
answer
244
views
Number of open sockets in /proc/pid/fd does not agree with netstat
I'm running into a weird socket issue when running my own crawler. It opens and cloees a lot of TCP sockets rapidly due to the protocol design. It's something I have to live with. I'm very sure in ...
- 163
0
votes
1
answer
143
views
Am I being hacked? can any one read this copy/paste netstat -ano?
i have an hp elitebook laptop with Linux mint and I have opened Firefox browser with four tabs: an empty tab and three from the streaming website solarmovie.zone
Even though no streaming is running ...
- 1
1
vote
0
answers
173
views
Turn a script do while to a systemctl service to intercept a tcp connection state
I made a little script that refresh browser, when web-server is down and connection is lost, with an infinite loop do/while true.
I want to turn it in a service for a better and clean solution.
The ...
- 51
-1
votes
2
answers
972
views
how to Find the port number according to PID [duplicate]
The following command can be used to find out which process is listening on a particular port:
netstat -ltnp | grep -w ':8011'
How can we do the opposite, find the port number according to PID ...
- 12.7k
0
votes
0
answers
441
views
get data from socket on port
I have a specific service that sends data on port 5555. I need to open socket on shell unix to listen on this port and print output on shell. Service is deployed as docker container.
So, I run ...
- 31
0
votes
0
answers
17
views
network services reachability troubleshooting
I have voyage linux on a system. It is running an apache server and an sshd. For some reason, i cannot connect to those services from another machine. There are no error logs that i have been able to ...
- 501
2
votes
1
answer
568
views
How to find a process by network domain it requests?
I noticed my Linux machine makes many DNS queries for a specific domain (subdomain) malicious.foo.bar
How can I find out which application or process tries to resolve this domain?
I also want to see ...
- 1,034
0
votes
1
answer
801
views
Can two servers bind the same port?
I was surprised to discover that two servers I'm maintaining are both able to listen on port 3000 in development at the same time.
With the first server running, netstat shows
▶ sudo netstat -nap ...
- 103
0
votes
1
answer
169
views
Sorting lines based on certain digit pattern
Assume I have a text file with the following lines:
192.168.1.1.55555
192.168.1.1.55555
192.168.1.1.5555
192.168.1.1.555
192.168.1.1.55
192.168.1.1.55
192.168.1.1.5
8.8.8.8.4433
8.8.8.8.443
8.8.8.8....
- 89
0
votes
1
answer
1k
views
How to show the "syn_sent" socket state on Linux in realtime?
I want to see the state "syn_sent" of socket in realtime during the connection process
ss or netstat or any command
I have tried those commands, but all fail
watch netstat -tnaop|grep -i syn
...
- 12.1k
0
votes
1
answer
195
views
View extended stats for listening ports (using ss?)
With ss -tuiOp we can view extended stats for an outbound process, e.g.:
tcp ESTAB 0 0 192.168.68.108:32862 52.86.220....
- 115
1
vote
1
answer
231
views
Fresh Fedora 35 - what are these active internet connections doing?
To get to this point I had a Fedora workstation 34 install- iso about a week old - ran update, rebooted, click Install Fedora 35 as it was on offer from gnome Software. Hadn't even opened Firefox yet. ...
- 265
2
votes
1
answer
734
views
Which interface does a specific IP address will get routed over?
Is there a way to determine which netdev or IP link interface that a given IP address will route over … in bash/shell language?
This is not about what an IP address is, given a network device name.
...
- 304
1
vote
1
answer
437
views
rhel + any best practice to minimize the CLOSE_WAIT sessions from linux side
when we perform the following cli on our rhel machine we get more then 600 CLOSE_WAIT lines
lsof -i tcp:8088 | grep CLOSE_WAIT
java 31100 yarn 385u IPv4 208022048 0t0 TCP master02.hgti.com:...
- 12.7k
0
votes
1
answer
332
views
how to know what the process that connected to my machine VIA specific port
with the following command I want to get which are the IP's that connected on my machine with port 8088
18.23.292.9 is machine that resource manager service is running on with port 8088
ss -tanp | ...
- 12.7k
1
vote
1
answer
1k
views
netstat cannot find opened port by iptables
My Linux command is following:
iptables -I INPUT -p tcp --dport 5002 -j ACCEPT
iptables-save
netstat -natp
but the result of netstat has no item about 5002.
2
votes
1
answer
427
views
iproute2 ss - not showing process/pid information if user is not the same user as listening process?
Is it normal behavior, or a bug, that when I run ss -nltp, I only see the process/pid information if the user I am running ss -nltp as is the same user as the listening process?
$ docker run -it --rm ...
- 133
0
votes
1
answer
773
views
Random SSH Agent Generates on Boot in tmp Directory Even with Networking Disabled
On a recently installed Debian system I noticed that every boot, even with no networking, a folder and empty socket file are generated in /tmp/ssh-(random_letters)/agent.xxx.
On every boot the random ...
1
vote
2
answers
153
views
How I can grep data with some spaces and ignoring block?
I am trying to retrieve Local Address-port with port number in different block used by each IP-address in Foreign Address and PID/Program name) from the following and store it in a file:
I used:
...
- 23
4
votes
1
answer
1k
views
How to find applications/ports that do bind() but don't do listen()?
When a faulty application calls bind() with a TCP socket to a port P but does not follow with listen(), the port P is not listed among open ports, i.e. netstat or ss or ls /proc/net/tcp do not show it,...
- 143
0
votes
1
answer
2k
views
How can I get CentOS to correctly list open ports?
I am working with CentOS 7 OS hosting a set of docker containers.
By using a web browser I can reach a service on port 80 and I get back a response.
A bit of local knowledge helps me understand that ...
- 135
1
vote
1
answer
800
views
netstat -lnp outputing results without PID
After using netstat -lnp I wonder how comes some of the result don't show any PID/Program name? Should I be worried? See below:
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local ...
- 109
0
votes
0
answers
166
views
How can I find out which processes are using my ports? Weird netstat output [duplicate]
I am trying to start a server that listens on 8080, but getting an error that the port is already in use. I am not running anything using that port.
Running netstat -ano -p tcp | grep tcp6 shows ...
- 1
-1
votes
3
answers
161
views
Can anyone get the default ip using only netstat -rn, while, read, and cut command?
As you can imagine, I should only use these commands to get the default IP of my virtual machine. netstat -rn gives the following output
Kernel IP routing table
Destination Gateway Genmask ......
3
votes
1
answer
11k
views
What does address 224.0.0.251:5353 represent?
I read some tutorials,they say that netstat is deprecated. I tried ss command. THis is the output
Netid State Recv-Q Send-Q Local Address:Port ...
- 33
1
vote
0
answers
729
views
socket statistics (ss) program weird ipv6 listening socket address format
I have two services listening on TCP/IPv6 sockets, ssh and mysql. ss shows this:
$ ss -tl6
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 ...
- 481
1
vote
0
answers
2k
views
How does netstat find ESTABLISHED connections
If I perform an operation that establishes a TCP connection (e.g., an HTTP connection), the first thing that happens is that the 3-step TCP handshake is made. If I then use netstat, it shows me that ...
0
votes
1
answer
236
views
loop using grep and adding to file
I am trying to loop a netstat and grep the results by some values, and then if they match- add them to a file, but it doesnt do a grep, but just adds the whole file:
#!/bin/bash
while true
do
sudo ...
- 101
0
votes
1
answer
175
views
Netstat doesn't show URLs while streaming from Youtube
Learning about networks and trying to make sense of netstat output. This is the main confusion:
When I run the command, there are no known URLs. For example, I'm listening a Youtube streaming and was ...
- 164
0
votes
1
answer
136
views
Netstat Killing Bash Process [duplicate]
I have a bit of bash script like this:
echo "Number of Connections: "
Conns=$(netstat -an | grep -c ‘8800.*OK’)
echo "Done"
It appears to stop processing after netstat. The ...
- 127