Questions tagged [netstat]

analysis tool for statistics about active connections, open sockets, routing tables; in general the networking subsystem.

Filter by
Sorted by
Tagged with
384
votes
5answers
764k views

Finding the PID of the process using a specific port?

I am installing hadoop on my Ubuntu system. When I start it, it reports that port 9000 is busy. I used: netstat -nlp|grep 9000 to see if such a port exists and I got this: tcp 0 0 ...
51
votes
14answers
53k views

What's the easiest way to find an unused local port?

What's the easiest way to find an unused local port? Currently I'm using something similar to this: port=$RANDOM quit=0 while [ "$quit" -ne 1 ]; do netstat -a | grep $port >> /dev/null if ...
50
votes
5answers
141k views

How to do an if statement from the result of an executed command

I am trying to do an IF statement from the output of an executed commmand. Here is how I am trying to do it, but it doesn't work. Does anyone know the right way to do this? if [ "`netstat -lnp | ...
50
votes
4answers
277k views

How do I know what service is running on a particular port in linux? [duplicate]

I am trying to run weblogic server on my linux machine and I am getting the following error : ERROR: transport error 202: bind failed: Address already in use ERROR: JDWP Transport dt_socket failed to ...
28
votes
6answers
12k views

chromium browser (pepperflashplugin) opening listening ports on 0.0.0.0:5353

I am using chromium browser (chrome) with pepperflashplugin in Debian. I have noticed, chromium/pepperflashplugin opens a listening port on my public interface 0.0.0.0:5353 as seen with netstat: ...
27
votes
4answers
84k views

How to check that a daemon is listening on what interface?

Ex.: an sshd is configured to only listen on wlan0. So. Besides checking the sshd_config how can I check that a daemon is listening on what inerface? netstat can do it? how? (OS: openwrt or scientific ...
22
votes
4answers
30k views

Logging outgoing connections as they happen

Is there a way to log to file all the outgoing connections that a process creates? I am aware of netstat but that seems to be more of a snapshot of a point in time rather than something that runs and ...
21
votes
3answers
25k views

alternative to “netstat -s”

netstat -s prints out a lot of very detailed protocol statistics like number of TCP reset messages received or number of ICMP "echo request" messages sent or number of packets dropped because of a ...
21
votes
2answers
34k views

netstat — why are IPv4 daemons listening to ports listed only in -A inet6?

I have a computer with: Linux superhost 3.2.0-4-amd64 #1 SMP Debian 3.2.60-1+deb7u3 x86_64 GNU/Linux It runs Apache on port 80 on all interfaces, and it does not show up in netstat -planA inet, ...
19
votes
5answers
32k views

meaning of Netstat local address column

When I do netstat -ntlp there is a column called Local Address: sometimes it would output IP address as 0.0.0.0:7180 and sometimes 127.0.0.1:9001 What's the implications of both notations? Does ...
19
votes
3answers
71k views

tcp6 in the output netstat

What does column 'tcp6' mean on output netstat? Please anyone explain the follow output of netstat: tcp6 0 0 dmz.local.net:www 5.140.235.6%14631:49964 ESTABLISHED 21393/apache2 What does tcp6 mean?
19
votes
2answers
6k views

Why is netstat deprecated? [closed]

I've heard many times now that it is, and I'm mostly using ss now. But I sometimes get frustrated with differences between the two, and I would love some insight. Also, I can't be the only one who ...
14
votes
5answers
20k views

Under AIX, how can I get the full path of a program bound to a port?

Under Linux I can use netstat -tulpnw and ps, like so: # netstat -tulpnw | grep :53 tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 1482/named udp ...
11
votes
0answers
1k views

Why is the default output of ss so strange? [duplicate]

When I run ss -tnlp to display all programs listening for tcp connections (something I do rather often) I get something like this: Despite the terminal being wide enough, ss chooses to split some ...
10
votes
3answers
14k views

port being in use not displayed in netstat output

In what scenarios port being used by a process don't show up in netstat -a output. I'm running jenkins on my machine. It's listening on port 8080. I'm trying to start another process that tries to ...
9
votes
3answers
7k views

Command similar to netstat -np but grouped by state and PID?

Is there a command similar to netstat -np but grouped by state and PID? I'd like to know the current count of server connections in a particular state grouped by Programs. similar to, 102 squid ...
8
votes
3answers
18k views

Why does SSH show protocol as tcp6 *and* tcp in netstat?

$ netstat -nat Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:80 0.0.0.0:...
8
votes
1answer
6k views

why ss(8) understands listening UDP ports differently than netstat(8)?

If I execute ss -lu in order to view all the listening UDP sockets, then none of the sockets are displayed. If I execute ss -au, which lists all(both listening and non-listening) UDP sockets, then "...
7
votes
1answer
5k views

TCP *:hbci (LISTEN) - What does hbci mean? [duplicate]

I simply open an http server from my terminal (with node) listening on port 3000, which is obviously working if I request localhost:3000 in a browser. Now, I want to see this connection so I use ...
6
votes
3answers
4k views

How can I know the process name which is opening a tcp port?

I have two linux servers. Let's say they are C and S. C is client of S On my S machine, I type. $ netstat -an | grep ESTABLISHED tcp 0 0 192.168.1.220:3306 C:57010 ...
6
votes
6answers
7k views

netstat: See process name like in `ps aux`

The postfix daemon has only the name "master" if I use netsat like this: root@myhost# netstat -tulpen| grep master tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 0 53191445 13640/master If I ...
6
votes
3answers
26k views

How to determine eth0 gateway address when it is not the default gateway?

In my system I have eth0 (which may or may not be connected) and a modem on ppp0 (which always may be up or down). The the case where both interfaces are up and ppp0 is the default route, I'd like to ...
6
votes
2answers
1k views

Netstat display wrong process associated to listening port

When I do netstat -tanup as root on my Debian host, process 1/init is displayed for port 993. How is this possible ? I never saw such behavior. The command systemctl list-sockets shows the correct ...
6
votes
2answers
4k views

Netstat output line width limit

When executing netstat, I find that the command's output width is limited regardless of the console size, in contrast with other commands such as ps that seem to get adjusted. So for example: $ sudo ...
6
votes
2answers
17k views

What does 0.0.0.0:* mean in netstat?

Could anyone explain the following output of netstat -plunt? udp 0 0 0.0.0.0:58262 **0.0.0.0:*** 1163/avahi-daemon: udp 0 0 0.0.0.0:17500 **0.0.0.0:***...
6
votes
1answer
6k views

Accounting for /proc/net/dev reported traffic

I noticed that according to /proc/net/dev I am constantly receiving around 6Kb/s on my wireless usb interface. But I can't account for anything even close to that with the individual connections that ...
5
votes
2answers
589 views

Language in netstat output

I have a program here, that depends on the output of netstat. More concrete: netstat -apn. Here is an example of a normal output. Proto Recv-Q Send-Q Local Address Foreign Address ...
5
votes
1answer
37k views

netstat shows an ESTABLISHED connection with no process

I am debugging some problems with postfix. When I establish a connection nothing happens and netstat shows: $ netstat -anp ... tcp 0 0 129.132.202.106:25 129.132.179.232:60154 ...
5
votes
4answers
8k views

How to list all unique ip address currently connected to a specific port?

Say I want to know how many unique clients are connected to port 5222 on a server. Can you find a way better/faster/stronger than this? netstat -nt | grep ':5222.*ESTABLISHED' | awk '{ print $5 }' \ ...
5
votes
2answers
3k views

Distinguish TCP server from client within netstat output

I have a socket connection between a client process and a server process, both running on my machine. There are two entries shown for the connection as, sudo netstat -ntp | grep 56442 tcp 1 ...
5
votes
0answers
227 views

What network connections are not seen by netstat/lsof/ss?

Network monitoring tools ss, lsof -i, netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with ip we can see other ...
4
votes
3answers
11k views

Source code of netstat

Can I view the source code of netstat on my Linux machine?
4
votes
2answers
209 views

Find which ports a program access

I have a program that tries to connect to a server on start-up on a unknown port. I need to find out which port the program accesses to enable a ssh tunnel. I tried netstat but since the connection ...
4
votes
1answer
1k views

ss not showing all ports being listened on

After doing a ssh -fND 1080 localhost, ssh will listen on port 1080 to provide the SOCKS service: box:~$ netstat -ln|grep 1080 tcp 0 0 127.0.0.1:1080 0.0.0.0:* ...
4
votes
1answer
435 views

log PID of each connection attempt

Finding the PID of an established connection is trivial using netstat or lsof. However, I have a process which is creating a connection ever 60 seconds to our database and locking it up by maxing out ...
4
votes
1answer
13k views

ss is replacing netstat, how can I get it to list ports similarly to what I am used to?

I've been trying to modernise my way with Linux by, for one thing, ditching netstat for ss. I looked up my favourite command line flag for netstat in the ss man pages, and was very glad to find that ...
4
votes
1answer
2k views

Why do I have Established TCP connections with no owner PID?

Both ss --processes and netstat --program (with sudo) list some ESTABLISHED TCP connections to local port 6514 with non-zero Recv-Q values and no owner process (netstat output shows - where PID/...
4
votes
1answer
620 views

Tons of unknown connections in nethogs

I am seeing hundreds of different connections to the same ip and port scrolling by when running nethogs. Occasionally the foreign IP and port will change (not always 80, but sometimes). I've noticed ...
3
votes
2answers
6k views

How to use lsof to identify incoming TCP connections?

I want to know if my server establishes a connection to a remote server or if the remote server tries to reach my server. I tried to read the output of lsof and obtain this information: lsof -i TCP:...
3
votes
2answers
4k views

does netstat established mean that someone is ssh'd into my machine

I ran the command netstat -lat and I got this output... ... tcp 0 0 my.machine.ip.add:ssh 116.31.116.48:43270 ESTABLISHED tcp 0 0 my.machine.ip.add:ssh my....
3
votes
1answer
3k views

How to report receive queue size for AF_UNIX sockets

netstat -a reports Recv-Q (amount of unread data pending for a reading application) for AF_INET sockets, but not AF_UNIX sockets (at least not for SOCK_DGRAM). Does anybody know a way to obtain this ...
3
votes
3answers
722 views

How can I list every port serving a web page

I have a number of servers, all with various HTTP(S) services accessible on a variety of ports. It's incredibly difficult to keep track of which service is available under which host and what port. ...
3
votes
2answers
10k views

Iptables rule to allow only one port and block others

We have two apps running (on top of linux) and both communicates through port 42605. I wanted to quickly verify if this is the only port that's been used for communication between them. I tried below ...
3
votes
3answers
2k views

How does one determine the process causing an ARP request?

I have a machine that runs a network intensive application that spawns many processes. I noticed recently that the machine is producing ARP requests looking for an IP address that does not exist. I ...
3
votes
1answer
1k views

“netstat -p”/“ss -p” not showing the process of a listening port

On my CentOS 7, at one point, sudo ss -plt listed a port marked as LISTENING on *:30565, but there was no information whatsoever in the process column of its row. The other listening ports were ...
3
votes
1answer
475 views

--numeric-ports option for netstat

$ netstat --version net-tools 1.60 netstat 1.42 (2001-04-15) Fred Baumgarten, Alan Cox, Bernd Eckenfels, Phil Blundell, Tuan Hoang and others +NEW_ADDRT +RTF_IRTT +RTF_REJECT +FW_MASQUERADE +I18N AF: (...
3
votes
1answer
2k views

How does netstat command fit in various layers of TCP/IP model in the performance diagram?

netstat command is useful to, Print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships. Now, I was reading about the Linux performance ...
3
votes
2answers
177 views

OS X: how to keep the computer from sleeping during a http connection

An application I use downloads data from a specific server, and I need it to sleep after the download has finished and the socket is closed. However downloads take place at random days, the app that ...
3
votes
0answers
424 views

Why does pepperflashplayer have almost 50 ports open?

So, I was messing around with netstat to learn more about addressing when I decided to run it on my local machine and see what processes were holding open ports. I came across this... tcp 0 ...
3
votes
0answers
765 views

dnsmasq uses many ports

I've executed the command sudo netstat -veepa -n -W and found many local ports which are used by dnsmasq: Proto Recv-Q Send-Q Local Address Foreign Address State User ...