Questions tagged [netstat]

analysis tool for statistics about active connections, open sockets, routing tables; in general the networking subsystem.

43 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
1answer
6k views

Accounting for /proc/net/dev reported traffic

I noticed that according to /proc/net/dev I am constantly receiving around 6Kb/s on my wireless usb interface. But I can't account for anything even close to that with the individual connections that ...
5
votes
0answers
229 views

What network connections are not seen by netstat/lsof/ss?

Network monitoring tools ss, lsof -i, netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with ip we can see other ...
4
votes
1answer
623 views

Tons of unknown connections in nethogs

I am seeing hundreds of different connections to the same ip and port scrolling by when running nethogs. Occasionally the foreign IP and port will change (not always 80, but sometimes). I've noticed ...
3
votes
0answers
424 views

Why does pepperflashplayer have almost 50 ports open?

So, I was messing around with netstat to learn more about addressing when I decided to run it on my local machine and see what processes were holding open ports. I came across this... tcp 0 ...
3
votes
0answers
765 views

dnsmasq uses many ports

I've executed the command sudo netstat -veepa -n -W and found many local ports which are used by dnsmasq: Proto Recv-Q Send-Q Local Address Foreign Address State User ...
3
votes
0answers
292 views

What does “incoming packets delivered” mean in “netstat -s” output on Linux?

While running netstat -s on Linux, I got below statistics for IP protocol (information for other protocols are omitted), Ip: 322937 total packets received 0 forwarded 0 incoming packets ...
3
votes
0answers
705 views

why do I have so many open socket handlers and netstat DGRAM entries?

I run on a RPi (Raspbian 3.12.35+ #730 PREEMPT Fri Dec 19 18:31:24 GMT 2014 armv6l GNU/Linux) a daemon in Python 2.7.8 which queries various APIs via requests and provides itself an API for another ...
2
votes
0answers
255 views

netstat show a listen port but pid don't exist and can't find it with lsof

I am running macOS(0.13.6) and while trying to test tinc, I get a warning that port 0.0.0.0:655 is already in use. This is the output I get from netstat: $ sudo netstat -anv -p udp Active Internet ...
2
votes
2answers
214 views

find pid of open tcp port, as a regular user

From local host I'm ssh tunneling some remote host:port to my local host:port, so anybody on a remote host can use their "local" port to access my port via that tunnel. I'm using some regular (non-...
2
votes
0answers
291 views

Getting incomplete output in netstat

Apache tomcat is running on port 8080, but netstat -tlnp does not show it, instead its output gets truncated with a binary character: # netstat -tlnp Active Internet connections (only servers) Proto ...
2
votes
0answers
537 views

Why doesn't netstat show me some ports?

When port-scanning my computer with another machine, I find three open ports: Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-08 22:14 CEST Nmap scan report for laptop.local (192.168.11.103) Host ...
2
votes
0answers
5k views

List services with port numbers

I would like to list all installed services (especially running) with their port numbers, where they are assigned. Could you be so glad and help me with this command?
2
votes
0answers
843 views

why i can see ipv6 socket with ipv6 stack disable?

I try to disable complety ipv6 on a Linux Debian 7 (wheezy) However , things escape me. In my case, i test with grafana process (I have same issue with munin, rpcbind etc) Method 1 : with sysctl ...
2
votes
0answers
308 views

Count all network requests to a specific host

I have a mock server running on my localhost that mocks out a back end service that I need for my app. One thing that I want to do is count the number of requests [GET, POST, PUT, DELETE,...] that my ...
2
votes
0answers
964 views

How do I find out how long a socket is in CLOSE_WAIT?

I have a server relatively with a high number of sockets in CLOSE_WAIT I want to know the age of each socket, to know if it's a real problem (sockets not getting closed) or that the sockets are ...
2
votes
1answer
862 views

Information about the 1630/master app

When I run $ sudo netstat -a --programs | grep LISTENING | grep 1630 I will get this output. Do you know what good are processes running under this app name? Why they are running on my system and if ...
1
vote
0answers
15 views

ss is slow when process option (-p) used

When checking for process listening on port using ss command, it's slow when compared with (obsolete) netstat command. $ time ss -nlp | grep -E ':8081|:8007|:8010' LISTEN 0 100 ...
1
vote
0answers
22 views

IGMPv3 Source Filtering Configuration

I know that multicast addresses are being kept in /proc/net/igmp. Where is the configuration for v3 source filter being kept? Please note that I do not wish to inspect actual IGMP packets, I wish to ...
1
vote
0answers
73 views

What does the inode column in netstat signify?

Issuing the command, netstat -pulet, there is an inode column that appears, and so issuing a find command I found that it links to inodes in the /sys/kernel/slab/cgroup/<...> section. For ...
1
vote
0answers
21 views

System statistics from different utilities don't agree

I am running an Aliyun instance with 8 vCPUs to do some high performance computing, so I want to make full use of the machine. In other words, extremely high CPU usage is not a problem; instead it is ...
1
vote
1answer
194 views

Difference of interfaces in netstat -i and netstat -i 1 1 command

Result of the netstat -i command in Solaris: # netstat -i Name Mtu Net/Dest Address Ipkts Ierrs Opkts Oerrs Collis Queue lo0 8232 loopback localhost 179 0 179 0 ...
1
vote
0answers
89 views

Show bound socket (but not listen) process

I am trying to understand how bind() works. I open a socket, and bind it to port 5001, but I don't execute listen() on it: sockfd = socket(AF_INET, SOCK_STREAM, 0); /* Initialize socket structure */ ...
1
vote
1answer
99 views

Confused about the “-a” switch of netstat on mac os

The -a switch documentation says the following: -a With the default display, show the state of all sockets; normally sockets used by server processes are not shown. With the routing ...
1
vote
1answer
502 views

Unix: Locating service configuration files on the file system

I have a Solaris 10 box which has limited tools and commands installed in comparison to Linux distros. In addition, the tools that can be used such as grep and netstat don't have the same options and ...
1
vote
0answers
374 views

Unknown network connections in nethogs (is it safe?)

It's about a month that I see some unknown connections in nethogs and I tried to understand what program is responsible for them but I failed. I'm not sure but it seems that my Internet connection ...
1
vote
1answer
788 views

What does TCPRcvCoalesce, TCPAutoCorking and TCPHystartTrainCwnd in netstat mean?

We have some RHEL7 Apache reverse proxies that experienced a performance degradation event. After a few hours, restarting Apache restored performance to normal levels. We are trying to determine the ...
1
vote
0answers
649 views

Arch Linux - Cronie is not working and nestat does not output logs?

I added a cronjob via crontab -e which is to be executed every minute. I enabled and started cronie on systemctl. Set editor $ export EDITOR=vim Add cront tasks $ crontab -e * * * * * Rscript /...
1
vote
0answers
491 views

Reverse AutoSSH working, but the proxied LISTEN ports fail randomly

I'm having a hard time describing the error, sorry for the lengthy explanation: I have a successful, working, stable reverse AutoSSH solution nailed up between a client beagle board and a server. The ...
1
vote
1answer
41 views

installed application keeps open port

I installed an application (a text editor) and it keeps a connection alive. I blocked the IP with iptables, but the port stays open. netstat shows: tcp 0 0 127.0.0.1:<port> 0.0.0.0:* ...
1
vote
0answers
862 views

How can I log outgoing TCP traffic including the full path of URLs?

I use a program regularly on Linux that makes a TCP request when it starts up and updates a file with an access token before launching. I'd like to write a batch script that makes this request (using ...
1
vote
0answers
568 views

Why doesn't syslog traffic show up in netstat and lsof output?

I've noticed on my CentOS 5.x system that outbound syslog traffic (UDP) doesn't show up in lsof or netstat results. I've even tried stuff like watch -n .1 'netstat -l -u -n --program' to make sure ...
1
vote
0answers
827 views

Command for finding open ports

On my linux servers I have this alias set: alias ns="sudo lsof -Pi|grep -v ESTABL|grep -v CLOSED|grep -v -e '->' | tr -s ' ' '\t' | awk '{print $3 "\t" $8 "\t" $5 "\t" $9 "\t" $1}'| column -t|...
0
votes
1answer
19 views

app.asar --nod ? What programme is it (in my netstat statistics?

What is app.asar --nod? jerzy@jerzy:~$ sudo netstat -tupln [sudo] password for jerzy: Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program ...
0
votes
0answers
161 views

netstat command for popular IP addresses OK in CentOS 6, fails in CentOS 7

In CentOS 6 w/ OpenVZ 2.6.32, this command outputs IPs with the highest number of connections against port 22, e.g: [root@legovz ~]# netstat -antu | grep :22 | grep -v LISTEN | awk '{print $5}' | cut ...
0
votes
0answers
18 views

Question on Netstat output “app --node-in” & other

While doing "netstat -p", I got result out of which, I am unable to understand below output:- unix 3 [ ] STREAM CONNECTED 3889891 23976/app --node-in unix 3 [ ] STREAM CONNECTED 33223 ...
0
votes
0answers
317 views

Tcp TCPBacklogDrop and packets pruned from receive queue

I am analyzing two virtual machines in the same LAN, tcp packet loss problem, but the knowledge has been exhausted. platform CentOS Linux release 7.2.1511 (Core) 3.10.0-327.el7.x86_64 #1 SMP Thu Nov ...
0
votes
0answers
293 views

Whose `I-Node` does `netstat -ap` for unix domain sockets refer to?

What does I-Node mean in the output of netstat -ap for unix domain sockets? It seems not the same as the inode of the socket file: $ netstat -ap ... Active UNIX domain sockets (servers and ...
0
votes
0answers
74 views

Performance of active port - netstat

Below command [root@machine1 output]# netstat -s --udp IcmpMsg: InType0: 371137 InType3: 296 InType8: 386843 InType11: 4 InType13: 141 InType15:...
0
votes
1answer
677 views

sudo netstat -antp not showing PID

i am testing stuff with sockets and i encountered that strange case : i coded i very simple tcp server in c, i made it block after accept(), just to see what happen when accepting multiple connection ...
0
votes
1answer
409 views

netstat (/proc/net): why is user associated with socket root? how to get user-id of 'remote' process?

ubuntu 16.04 I have 2 node applications, app-1 and app-2, with usernames matching their application names, listening locally (on ports 8001 and 8002, respectively) on the same instance. When app-1 ...
0
votes
0answers
1k views

can't connect to remote host with MySQL…firewall problem?

I've granted privileges to thufir for remote access through the shell (correct?), but cannot seem to actually connect. The router firewall has SPI to off. I've disable the IPv6 firewall on the ...
0
votes
2answers
3k views

Killed process blocks TCP ports

I've had this issue on several machines. Is there some way to free this blocked port? Here is an example: Let me explain. I've killed some JAVA-Process on SUSE Linux Enterprise Server 11 SP4, which ...
-1
votes
0answers
30 views

Is it normal to have multicast connections even with airplane mode turned on?

I'm a bit paranoid because my phone is acting weird and my notebook is displaying the following while in airplane mode: ip maddr show 1: lo inet 224.0.0.1 inet6 ff02::1 inet6 ff01::1 2: ...