Questions tagged [netstat]
analysis tool for statistics about active connections, open sockets, routing tables; in general the networking subsystem.
261
questions
2
votes
1
answer
711
views
lxterminal in the netstat output
Can you explain the following lines in the netstat output?
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ] STREAM ...
0
votes
2
answers
654
views
Looking for clarification on netstat results
I am looking for some clarification on the following netstat results. The following results are showing 3 java processes. Is there a way to find which java programs are they referring to?
Another ...
6
votes
1
answer
47k
views
netstat shows an ESTABLISHED connection with no process
I am debugging some problems with postfix. When I establish a connection nothing happens and netstat shows:
$ netstat -anp
...
tcp 0 0 129.132.202.106:25 129.132.179.232:60154 ...
0
votes
1
answer
651
views
List TCP connections
How can I format netstat output so I have a list of TCP connections made to the server?
A bit like this:
192.168.234.1 51780
192.168.234.221 51444
192.168.234.251 51447
The closest I got was six ...
0
votes
1
answer
841
views
Two local address listening on same port?
How is it possible that netstat -a | grep 8081 shows this:
localhost.8081 *.* 0 0 49152 0 LISTEN
*.8081 *.* 0 0 49152 ...
1
vote
1
answer
338
views
Significance of output of netstat -i command in AIX
The output of the netstat-i command on AIX 7.1 / AIX 7.2 :
Name Mtu Network Address Ipkts Ierrs Opkts Oerrs Coll
en0 65390 link#2 e2.f9.3a.a8.fc.2 1205 0 71 ...
1
vote
2
answers
4k
views
How to display an UDP connection?
ss and netstat seem to not be working.
Adobe Flash RTMFP protocol creates a lots of UDP connections. I want to know, who is connected to me.
I can see intense data-send traffic from the monitor.
I ...
1
vote
1
answer
608
views
Difference of interfaces in netstat -i and netstat -i 1 1 command
Result of the netstat -i command in Solaris:
# netstat -i
Name Mtu Net/Dest Address Ipkts Ierrs Opkts Oerrs Collis Queue
lo0 8232 loopback localhost 179 0 179 0 ...
0
votes
1
answer
1k
views
Are the 'Local Address' and 'Remote Address' netstat columns symmetrical for localhost?
If I have the following netstat output:
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:3306 127.0.0.1:21950 ...
7
votes
1
answer
29k
views
How to figure out the meaning behind Recv-Q and Send-Q from netstat?
netstat -ntp
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 8216172 0 127.0.0.1:9503 ...
3
votes
1
answer
2k
views
--numeric-ports option for netstat
$ netstat --version
net-tools 1.60
netstat 1.42 (2001-04-15)
Fred Baumgarten, Alan Cox, Bernd Eckenfels, Phil Blundell, Tuan Hoang and others
+NEW_ADDRT +RTF_IRTT +RTF_REJECT +FW_MASQUERADE +I18N
AF: (...
0
votes
2
answers
164
views
Capture internet traffic on single interface
I have been asked by a customer to provide a list of all URL's that my company's linux server connects to in order to complete a software update including individual TCP,UDP ports that these ...
1
vote
0
answers
127
views
Show bound socket (but not listen) process
I am trying to understand how bind() works.
I open a socket, and bind it to port 5001, but I don't execute listen() on it:
sockfd = socket(AF_INET, SOCK_STREAM, 0);
/* Initialize socket structure */
...
1
vote
1
answer
140
views
Open connections with unresolvable domain
Output of sudo watch lsof -i and sudo watch netstat -tp show ESTABLISHED connections with unresolvable domain (e.g., host, dig woldn't resolve, trying to access domain directly via URL from firefox ...
6
votes
1
answer
3k
views
Why do I have Established TCP connections with no owner PID?
Both ss --processes and netstat --program (with sudo) list some ESTABLISHED TCP connections to local port 6514 with non-zero Recv-Q values and no owner process (netstat output shows - where PID/...
0
votes
1
answer
3k
views
Why do RX-OK and TX-OK increase
I'm testing my linux server with the command netstat -i.
I just want to know what enp2s0f0 means. Each time that I execute netstat -i, its RX-OK and TX-OK always increase. What does this mean?
1
vote
2
answers
3k
views
/proc/net/tcp: permission denied
When I type netstat into my SSH console as a non root user, I get
/proc/net/tcp: permission denied
but it works fine as root. I was wondering if it's possible how I would allow non root users to ...
4
votes
3
answers
6k
views
How does one determine the process causing an ARP request?
I have a machine that runs a network intensive application that spawns many processes. I noticed recently that the machine is producing ARP requests looking for an IP address that does not exist. I ...
1
vote
1
answer
228
views
Confused about the "-a" switch of netstat on mac os
The -a switch documentation says the following:
-a With the default display, show the state of all sockets; normally sockets used by server processes
are not shown. With the routing ...
1
vote
1
answer
3k
views
Netstat doesn't show my machine IP as listening on port 22
I am able to ssh to the machine.
But my machine not shown as listening on port 22.
Below is what I see.
It show as listening on port 53, 21, 8080, 8443 etc. But no entry for 22(ssh).
My machine IP is ...
14
votes
5
answers
23k
views
Under AIX, how can I get the full path of a program bound to a port?
Under Linux I can use netstat -tulpnw and ps, like so:
# netstat -tulpnw | grep :53
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 1482/named
udp ...
32
votes
2
answers
58k
views
netstat — why are IPv4 daemons listening to ports listed only in -A inet6?
I have a computer with:
Linux superhost 3.2.0-4-amd64 #1 SMP Debian 3.2.60-1+deb7u3 x86_64 GNU/Linux
It runs Apache on port 80 on all interfaces, and it does not show up in netstat -planA inet, ...
3
votes
3
answers
2k
views
script to verify running services on specific ports
I got a task to do.
I have to search whether, are there running services on below ports.
ports 53 & 55
If not I have to send alerts.
Please correct my logic and syntax in below code for one port
...
2
votes
1
answer
1k
views
Information about the 1630/master app
When I run
$ sudo netstat -a --programs | grep LISTENING | grep 1630
I will get this output. Do you know what good are processes running under this app name? Why they are running on my system and if ...
0
votes
2
answers
2k
views
/proc/net/netstat not found
I am trying to compile my own Linux for embededd devices, using the OpenWRT distribution. I am trying to get some Multicast information using the /proc/net/netstat interface but it is not found (...
3
votes
1
answer
1k
views
netstat output is "ESTABLISHED -" (no program name attached). What is the issue?
My server program is running and I am trying to establish some TCP connections from redis client.
I am trying to establish 1150 client connections, and when I check netstat at server side I find a ...
31
votes
2
answers
16k
views
Why is netstat deprecated? [closed]
I've heard many times now that it is, and I'm mostly using ss now. But I sometimes get frustrated with differences between the two, and I would love some insight.
Also, I can't be the only one who ...
0
votes
2
answers
435
views
Print ports with the application using it
I want to print 2 fields together, all open ports and the application using it. This is my command but it only prints the port numbers and still missing the program field:
netstat -lnt -u -p | awk '{...
5
votes
3
answers
25k
views
What process is listening on a port?
[root@SERVER ~]# netstat -tulpn | grep 44316
tcp 0 0 :::44316 :::* LISTEN -
[root@SERVER ~]# lsof -i | grep 44316
[root@...
1
vote
1
answer
2k
views
Why I see this output in netstat (Local Address)
I have a server in a small network. This server has a hostname, let's say hostname1.network.internal. And the current IP adress of this server is 192.168.0.54.
But when I call the command netstat | ...
2
votes
1
answer
1k
views
netstat, listing connections correctly
I have 2 machines
A 192.168.0.40 (CentOS)
B 192.168.0.41 (Debian)
Gateway 192.168.0.2
Now I did set a port forwarding using firewallD, from
A port 2245
to
B port 22
Connection established from ...
0
votes
1
answer
872
views
How to identify and kill git listening services here?
I am studying my listening services, and I am thinking how identify the type of git listening services so I can kill git the right one in the right situation and/or both.
The services are needed for ...
7
votes
1
answer
21k
views
netstat show port number instead of process name
I want to see which port, e.g. postgresql is listening on, so I use:
netstat -l
But that is trying to be clever and prints the process name instead of the port:
Active Internet connections (only ...
6
votes
2
answers
3k
views
Netstat display wrong process associated to listening port
When I do netstat -tanup as root on my Debian host, process 1/init is displayed for port 993. How is this possible ? I never saw such behavior.
The command systemctl list-sockets shows the correct ...
2
votes
0
answers
1k
views
Why doesn't netstat show me some ports?
When port-scanning my computer with another machine, I find three open ports:
Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-08 22:14 CEST
Nmap scan report for laptop.local (192.168.11.103)
Host ...
3
votes
0
answers
566
views
Why does pepperflashplayer have almost 50 ports open?
So, I was messing around with netstat to learn more about addressing when I decided to run it on my local machine and see what processes were holding open ports.
I came across this...
tcp 0 ...
1
vote
1
answer
615
views
Shows One Shell User, But More Connection Via SSH Port
I've just run the command on my server
netstat -atnp
It shows 2 established connection via SSH Port, but when I run the command
w
It shows only 1 shell user. Is there anything I need to worry ...
0
votes
2
answers
1k
views
netstat shows over 44K connections without ip address, what's that?
I have a question about linux netstat usage and output results. I'm trying to solve a dilema about why my server is facing communications delays and bottle neck issues, So I started digging and ...
0
votes
1
answer
584
views
netstat (/proc/net): why is user associated with socket root? how to get user-id of 'remote' process?
ubuntu 16.04
I have 2 node applications, app-1 and app-2, with usernames matching their application names, listening locally (on ports 8001 and 8002, respectively) on the same instance. When app-1 ...
11
votes
0
answers
1k
views
Why is the default output of ss so strange? [duplicate]
When I run ss -tnlp to display all programs listening for tcp connections (something I do rather often) I get something like this:
Despite the terminal being wide enough, ss chooses to split some ...
1
vote
1
answer
2k
views
How to get the pid number which connect to external ip?
Some program was connected from my local ip 111.111.111.111 with 130.239.18.176:80,how to get the pid number?
netstat -np
(Not all processes could be identified, non-owned process info
will not be ...
-1
votes
1
answer
11k
views
How to find all the incoming traffic in the linux server [closed]
How to find all the incoming traffic to the linux server. It should show only incoming traffics.
1
vote
2
answers
6k
views
How to use netstat command
My question is what does it mean to LISTEN or ACCEPT on a port as it relates to my example?
Example: I have a tomcat server, and It will use port 8080. I want to make sure that port is available for ...
6
votes
4
answers
11k
views
How to list all unique ip address currently connected to a specific port?
Say I want to know how many unique clients are connected to port 5222 on a server.
Can you find a way better/faster/stronger than this?
netstat -nt | grep ':5222.*ESTABLISHED' | awk '{ print $5 }' \
...
2
votes
1
answer
1k
views
number of HTTP sessions=number of TCP Sessions?
I have a software that has an HTTP server listening on port 20001 and running on a Unix machine. The logfile of the HTTP server says it currently has 600+ active HTTP connections, however netstat -an |...
28
votes
5
answers
48k
views
meaning of Netstat local address column
When I do netstat -ntlp there is a column called Local Address:
sometimes it would output IP address as 0.0.0.0:7180
and sometimes 127.0.0.1:9001
What's the implications of both notations?
Does ...
6
votes
2
answers
14k
views
does netstat established mean that someone is ssh'd into my machine
I ran the command netstat -lat
and I got this output...
...
tcp 0 0 my.machine.ip.add:ssh 116.31.116.48:43270 ESTABLISHED
tcp 0 0 my.machine.ip.add:ssh my....
0
votes
1
answer
2k
views
Why can `lsof -i` not show an open connection which `netstat -n` lists?
A strange situation. I started
telnet 0 8081
and lsof -i (run under root) doesn't list this connection, but netstat -n does.
Why can this be?
0
votes
1
answer
67
views
how to find which process / service do criminal traffic via port 11413
we get message from our security department
about criminal traffic via port 11413 from linux machine A to linux machine B
please advice how to find who use this port and details about the traffic
...
3
votes
0
answers
1k
views
why do I have so many open socket handlers and netstat DGRAM entries?
I run on a RPi (Raspbian 3.12.35+ #730 PREEMPT Fri Dec 19 18:31:24 GMT 2014 armv6l GNU/Linux) a daemon in Python 2.7.8 which queries various APIs via requests and provides itself an API for another ...