Questions tagged [netstat]

analysis tool for statistics about active connections, open sockets, routing tables; in general the networking subsystem.

Filter by
Sorted by
Tagged with
-1
votes
0answers
30 views

Is it normal to have multicast connections even with airplane mode turned on?

I'm a bit paranoid because my phone is acting weird and my notebook is displaying the following while in airplane mode: ip maddr show 1: lo inet 224.0.0.1 inet6 ff02::1 inet6 ff01::1 2: ...
0
votes
2answers
2k views

Killed process blocks TCP ports

I've had this issue on several machines. Is there some way to free this blocked port? Here is an example: Let me explain. I've killed some JAVA-Process on SUSE Linux Enterprise Server 11 SP4, which ...
1
vote
0answers
369 views

Unknown network connections in nethogs (is it safe?)

It's about a month that I see some unknown connections in nethogs and I tried to understand what program is responsible for them but I failed. I'm not sure but it seems that my Internet connection ...
1
vote
0answers
15 views

ss is slow when process option (-p) used

When checking for process listening on port using ss command, it's slow when compared with (obsolete) netstat command. $ time ss -nlp | grep -E ':8081|:8007|:8010' LISTEN 0 100 ...
1
vote
1answer
22 views

What does the reordering field of ss --info mean?

ss --info returns information about tcp connections. It produces a line simliar to the following (some fields removed for formatting) tcp ESTAB 0 0 192.168.1.177:60236 54.70.141.88:...
22
votes
4answers
30k views

Logging outgoing connections as they happen

Is there a way to log to file all the outgoing connections that a process creates? I am aware of netstat but that seems to be more of a snapshot of a point in time rather than something that runs and ...
0
votes
1answer
18 views

Find the short-lived process that is polling my port?

I've noticed one of the headless computers in my network is constantly polling the VNC port on another computer. My problem is, that when I see the port from which it has connected (with tcpdump) and ...
1
vote
0answers
21 views

IGMPv3 Source Filtering Configuration

I know that multicast addresses are being kept in /proc/net/igmp. Where is the configuration for v3 source filter being kept? Please note that I do not wish to inspect actual IGMP packets, I wish to ...
-7
votes
1answer
61 views

Strange logs in Linux [closed]

I ran sudo lsof -i :80 on port 80 to check what is port 80 listening to and I got the output bellow. I dont understand what this means. It seems like some program is running on our server and using ...
-1
votes
1answer
58 views

How do I get my terminal to show the entire output of my command?

terminal command: watch netstat -nalp I get an output, but I am not able to scroll down to see the majority of the output. I can only see as far down as I extend the bottom of the terminal (box). I ...
5
votes
0answers
226 views

What network connections are not seen by netstat/lsof/ss?

Network monitoring tools ss, lsof -i, netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with ip we can see other ...
6
votes
1answer
6k views

Accounting for /proc/net/dev reported traffic

I noticed that according to /proc/net/dev I am constantly receiving around 6Kb/s on my wireless usb interface. But I can't account for anything even close to that with the individual connections that ...
0
votes
1answer
914 views

Why is my Netstat not returning the desired output and just getting hung up?

My remote Linux machine is able to ping an IP address on an internet, but the same action is unable to get the netstat report for that IP. ping a.b.c.d 64 bytes from a.b.c.d: icmp_seq=1 ttl=64 time=...
6
votes
3answers
26k views

How to determine eth0 gateway address when it is not the default gateway?

In my system I have eth0 (which may or may not be connected) and a modem on ppp0 (which always may be up or down). The the case where both interfaces are up and ppp0 is the default route, I'd like to ...
27
votes
4answers
84k views

How to check that a daemon is listening on what interface?

Ex.: an sshd is configured to only listen on wlan0. So. Besides checking the sshd_config how can I check that a daemon is listening on what inerface? netstat can do it? how? (OS: openwrt or scientific ...
0
votes
1answer
19 views

app.asar --nod ? What programme is it (in my netstat statistics?

What is app.asar --nod? jerzy@jerzy:~$ sudo netstat -tupln [sudo] password for jerzy: Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program ...
1
vote
0answers
72 views

What does the inode column in netstat signify?

Issuing the command, netstat -pulet, there is an inode column that appears, and so issuing a find command I found that it links to inodes in the /sys/kernel/slab/cgroup/<...> section. For ...
0
votes
0answers
159 views

netstat command for popular IP addresses OK in CentOS 6, fails in CentOS 7

In CentOS 6 w/ OpenVZ 2.6.32, this command outputs IPs with the highest number of connections against port 22, e.g: [root@legovz ~]# netstat -antu | grep :22 | grep -v LISTEN | awk '{print $5}' | cut ...
6
votes
6answers
7k views

netstat: See process name like in `ps aux`

The postfix daemon has only the name "master" if I use netsat like this: root@myhost# netstat -tulpen| grep master tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 0 53191445 13640/master If I ...
1
vote
1answer
99 views

Why does postgresql server have a `localhost:57504` to `localhost:57504` UDP “connection”?

$ sudo netstat -ap | grep postg tcp 0 0 localhost:postgresql 0.0.0.0:* LISTEN 1567/postgres udp 0 0 localhost:57504 localhost:57504 ...
-3
votes
1answer
161 views

What do `0.0.0.0:*`, `[::]:mysql`, and `[::]:*` mean in netstat output?

$ sudo netstat -ap | grep postg tcp 0 0 localhost:postgresql 0.0.0.0:* LISTEN 1567/postgres udp 0 0 localhost:57504 localhost:57504 ...
0
votes
1answer
21 views

Does `netstat` output different sockets with and without -n?

man netstat says --numeric, -n Show numerical addresses instead of trying to determine symbolic host, port or user names. Does netstat output additional sockets with -n than without -n? Or ...
1
vote
0answers
21 views

System statistics from different utilities don't agree

I am running an Aliyun instance with 8 vCPUs to do some high performance computing, so I want to make full use of the machine. In other words, extremely high CPU usage is not a problem; instead it is ...
0
votes
2answers
86 views

How can I find the mapping on `$DISPLAY` after `ssh -X`?

On machine B, I remote access machine C $ ssh -X t@C $ echo $DISPLAY localhost:10.0 How can I find/verify the mapping of $DISPLAY on C to $DISPLAY on B? Can it be done by the following command ...
1
vote
1answer
47 views

confused by netstat result

I ssh to my ubuntu server and run sudo netstat -a -p and I get this: tcp 0 0 ip-172-31-25-123.us:ssh mailDOTjjtoursDOTcom:54531 ESTABLISHED 1516/sshd: ubuntu [ And when I use my other ...
0
votes
1answer
553 views

Stalled TCP connection with data in RecvQ and ESTABLISHED off

My networking skills are quite poor and I am trying to understand the following netstat -ton meaning. We have redis server and a client with a thread connecting to it via PUB/SUB. The client ...
2
votes
1answer
61 views

Red Hat Linux - port is in listening state but could not find process ID

I have this problem for my application, port is in listening state but process ID is not showing up. Used below commands. This is cloud AWS server Red Hat Linux. $ netstat -tulpn tcp 0 ...
2
votes
1answer
748 views

reading TCP connection list from /proc

I'm trying to implement code that enumerate all existing TCP connections per process (similar to netstat -lptn). I prefer to implement it myself and not to rely on netstat. In order to do that, I'm ...
51
votes
14answers
53k views

What's the easiest way to find an unused local port?

What's the easiest way to find an unused local port? Currently I'm using something similar to this: port=$RANDOM quit=0 while [ "$quit" -ne 1 ]; do netstat -a | grep $port >> /dev/null if ...
0
votes
0answers
18 views

Question on Netstat output “app --node-in” & other

While doing "netstat -p", I got result out of which, I am unable to understand below output:- unix 3 [ ] STREAM CONNECTED 3889891 23976/app --node-in unix 3 [ ] STREAM CONNECTED 33223 ...
0
votes
2answers
209 views

How can I verify that the port forwarding is established by checking the sockets?

After I run $ ssh -L 9000:google.com:80 testme@localhost how can I verify that the port forwarding is established by checking the sockets (internet and unix domain sockets)? Thanks.
0
votes
0answers
315 views

Tcp TCPBacklogDrop and packets pruned from receive queue

I am analyzing two virtual machines in the same LAN, tcp packet loss problem, but the knowledge has been exhausted. platform CentOS Linux release 7.2.1511 (Core) 3.10.0-327.el7.x86_64 #1 SMP Thu Nov ...
0
votes
1answer
73 views

Process appear by “netstat” but doesn't appear by “ps -a”

I have a machine in my organization that I sshed and received a terminal. When I run netstat -ntlp I received: [root@webtl1 ~]# netstat -ntlp Active Internet connections (only servers) Proto ...
3
votes
2answers
10k views

Iptables rule to allow only one port and block others

We have two apps running (on top of linux) and both communicates through port 42605. I wanted to quickly verify if this is the only port that's been used for communication between them. I tried below ...
-2
votes
1answer
76 views

Is a terminal emulator process a server? [duplicate]

Is a temrinal emulator process a server? If yes, what is its client(s)? How can I find out its client(s)? Thanks. netstat output contains lxterminal processes. Does that mean that a terminal ...
384
votes
5answers
764k views

Finding the PID of the process using a specific port?

I am installing hadoop on my Ubuntu system. When I start it, it reports that port 9000 is busy. I used: netstat -nlp|grep 9000 to see if such a port exists and I got this: tcp 0 0 ...
2
votes
1answer
76 views

Why doesn't `netstat` show Screen client but only Screen server process?

From https://unix.stackexchange.com/a/485290/674 Further down in the netstat output is UNIX sockets: Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State ...
1
vote
2answers
107 views

What is the server-client relationship between a terminal emulator, a window manager and a X server processes?

In APUE (see the figure below), how do a terminal emulator process and a window manager (e.g. openbox) process communicate? Is a temrinal emulator process a client of a window manager process, based ...
0
votes
2answers
36 views

How can I find out the Screen server process?

Does GNU Screen have a server-client architecture model? Is each Screen session a Screen client process? Why can't I find out the Screen server process, but only its session processes i.e. ...
0
votes
0answers
280 views

Whose `I-Node` does `netstat -ap` for unix domain sockets refer to?

What does I-Node mean in the output of netstat -ap for unix domain sockets? It seems not the same as the inode of the socket file: $ netstat -ap ... Active UNIX domain sockets (servers and ...
0
votes
1answer
92 views

How to close nc port in Debian 9?

I am struggling to close these ports which seem to be backdoors -- or at least I have never opened and used them. How can I close or shutdown nc and close these ports? netstat -lntup | grep nc ps-...
2
votes
0answers
307 views

Count all network requests to a specific host

I have a mock server running on my localhost that mocks out a back end service that I need for my app. One thing that I want to do is count the number of requests [GET, POST, PUT, DELETE,...] that my ...
2
votes
0answers
291 views

Getting incomplete output in netstat

Apache tomcat is running on port 8080, but netstat -tlnp does not show it, instead its output gets truncated with a binary character: # netstat -tlnp Active Internet connections (only servers) Proto ...
-1
votes
1answer
97 views

Why does atop open a raw socket?

I install atop on Debian 9. It runs as a monitoring daemon. Why is it listening on a raw socket? Raw sockets are used to generate arbitrary IPv4 packets or capture all packets read all packets for ...
0
votes
1answer
484 views

ss shows a raw socket. What does it mean that it is listening on “*:ipproto-255”?

What does ss mean by *:ipproto-255, in the local address/port column? $ sudo ss -ap | grep -vE "^(nl |u_)" Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port p_raw UNCONN 0 ...
1
vote
2answers
3k views

Is there documentation for /proc/net/netstat and /proc/net/snmp?

There is a long list of stats in /proc/net/netstat and /proc/net/snmp, both of which I think come from the net-tools project. Is there any official or unofficial documentation about these fields? Or ...
0
votes
0answers
74 views

Performance of active port - netstat

Below command [root@machine1 output]# netstat -s --udp IcmpMsg: InType0: 371137 InType3: 296 InType8: 386843 InType11: 4 InType13: 141 InType15:...
2
votes
0answers
255 views

netstat show a listen port but pid don't exist and can't find it with lsof

I am running macOS(0.13.6) and while trying to test tinc, I get a warning that port 0.0.0.0:655 is already in use. This is the output I get from netstat: $ sudo netstat -anv -p udp Active Internet ...
6
votes
2answers
4k views

Netstat output line width limit

When executing netstat, I find that the command's output width is limited regardless of the console size, in contrast with other commands such as ps that seem to get adjusted. So for example: $ sudo ...
0
votes
1answer
73 views

Monitor Nextcloud connections with netstat

I'm not able to detect incoming connections from Nextcloud sync clients via netstat on my server. I have a server in my LAN, running Nextcloud with MySQL in docker containers. I use multiple ...