Questions tagged [netstat]

analysis tool for statistics about active connections, open sockets, routing tables; in general the networking subsystem.

Filter by
Sorted by
Tagged with
0
votes
2answers
4k views

Why doesn't my client IP address appear in the netstat output?

My client is a MS Excel plug-in running on my laptop (client_machine1) that connects to a Solaris server (server1) to request some WebLogic Application running on port 28080. bash-3.2$ set | grep ...
0
votes
1answer
22 views

Find the short-lived process that is polling my port?

I've noticed one of the headless computers in my network is constantly polling the VNC port on another computer. My problem is, that when I see the port from which it has connected (with tcpdump) and ...
0
votes
2answers
101 views

How can I find out the Screen server process?

Does GNU Screen have a server-client architecture model? Is each Screen session a Screen client process? Why can't I find out the Screen server process, but only its session processes i.e. ...
0
votes
1answer
118 views

How to close nc port in Debian 9?

I am struggling to close these ports which seem to be backdoors -- or at least I have never opened and used them. How can I close or shutdown nc and close these ports? netstat -lntup | grep nc ps-...
0
votes
1answer
724 views

ss shows a raw socket. What does it mean that it is listening on “*:ipproto-255”?

What does ss mean by *:ipproto-255, in the local address/port column? $ sudo ss -ap | grep -vE "^(nl |u_)" Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port p_raw UNCONN 0 ...
0
votes
1answer
85 views

Monitor Nextcloud connections with netstat

I'm not able to detect incoming connections from Nextcloud sync clients via netstat on my server. I have a server in my LAN, running Nextcloud with MySQL in docker containers. I use multiple ...
0
votes
1answer
332 views

Two local address listening on same port?

How is it possible that netstat -a | grep 8081 shows this: localhost.8081 *.* 0 0 49152 0 LISTEN *.8081 *.* 0 0 49152 ...
0
votes
1answer
425 views

Are the 'Local Address' and 'Remote Address' netstat columns symmetrical for localhost?

If I have the following netstat output: Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:3306 127.0.0.1:21950 ...
0
votes
1answer
728 views

Why I see this output in netstat (Local Address)

I have a server in a small network. This server has a hostname, let's say hostname1.network.internal. And the current IP adress of this server is 192.168.0.54. But when I call the command netstat | ...
0
votes
2answers
695 views

/proc/net/netstat not found

I am trying to compile my own Linux for embededd devices, using the OpenWRT distribution. I am trying to get some Multicast information using the /proc/net/netstat interface but it is not found (...
0
votes
1answer
58 views

how to find which process / service do criminal traffic via port 11413

we get message from our security department about criminal traffic via port 11413 from linux machine A to linux machine B please advice how to find who use this port and details about the traffic ...
0
votes
1answer
440 views

reading the output of netstat for tcp

If I ssh root@server -R 5901:localhost:5900 and netstat -an I get: Active Internet connections (servers and established) │ Proto Recv-Q Send-Q Local Address ...
0
votes
1answer
86 views

How to monitor all the connections?

I have a server with several users, one of them has a script to connect to an external server. How can I see the external connection to the server (I know the IP address), so the program used and the ...
0
votes
1answer
87 views

Open ports with no associated PIDs

I have some open ports on my laptop but netstat is not reporting which PID/Program is associated with them: $ netstat -tulpn (Not all processes could be identified, non-owned process info will not ...
0
votes
1answer
829 views

kstat in Solaris 11+

I'm writing a kernel-level program in Solaris that monitors the workload of the system and reports the stats --something similar to netstats in linux and kstat in Solaris. Where the source code for ...
0
votes
2answers
1k views

Routing Configuration sending some traffic over VPN

I have a DD-WRT router with an OpenVPN service configured. I'd like to send only certain source IP's over the vpn connection. I believe my current routing table (as seen with netstat -rn) sends all ...
0
votes
0answers
6 views

Uhttpd requests stucks my device

I have a Web Server running on a devices under uhttpd. I have N devices ( N could be 25 ) that send request to the main devices. Everything works correctly when the main devices is running, but during ...
0
votes
1answer
30 views

Many Send-Q have packets TCP connections, is this abnormality? what caused this?

The 125.193.242.25 is a CDN node, and when I analyze the TCP connect, there shows below information: [root@hkk10 ~]# netstat -na Active Internet connections (servers and established) Proto Recv-Q ...
0
votes
1answer
25 views

app.asar --nod ? What programme is it (in my netstat statistics?

What is app.asar --nod? jerzy@jerzy:~$ sudo netstat -tupln [sudo] password for jerzy: Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program ...
0
votes
0answers
191 views

netstat command for popular IP addresses OK in CentOS 6, fails in CentOS 7

In CentOS 6 w/ OpenVZ 2.6.32, this command outputs IPs with the highest number of connections against port 22, e.g: [root@legovz ~]# netstat -antu | grep :22 | grep -v LISTEN | awk '{print $5}' | cut ...
0
votes
0answers
19 views

Question on Netstat output “app --node-in” & other

While doing "netstat -p", I got result out of which, I am unable to understand below output:- unix 3 [ ] STREAM CONNECTED 3889891 23976/app --node-in unix 3 [ ] STREAM CONNECTED 33223 ...
0
votes
0answers
460 views

Tcp TCPBacklogDrop and packets pruned from receive queue

I am analyzing two virtual machines in the same LAN, tcp packet loss problem, but the knowledge has been exhausted. platform CentOS Linux release 7.2.1511 (Core) 3.10.0-327.el7.x86_64 #1 SMP Thu Nov ...
0
votes
0answers
481 views

Whose `I-Node` does `netstat -ap` for unix domain sockets refer to?

What does I-Node mean in the output of netstat -ap for unix domain sockets? It seems not the same as the inode of the socket file: $ netstat -ap ... Active UNIX domain sockets (servers and ...
0
votes
0answers
86 views

Performance of active port - netstat

Below command [root@machine1 output]# netstat -s --udp IcmpMsg: InType0: 371137 InType3: 296 InType8: 386843 InType11: 4 InType13: 141 InType15:...
0
votes
1answer
855 views

sudo netstat -antp not showing PID

i am testing stuff with sockets and i encountered that strange case : i coded i very simple tcp server in c, i made it block after accept(), just to see what happen when accepting multiple connection ...
0
votes
1answer
762 views

Why do RX-OK and TX-OK increase

I'm testing my linux server with the command netstat -i. I just want to know what enp2s0f0 means. Each time that I execute netstat -i, its RX-OK and TX-OK always increase. What does this mean?
0
votes
1answer
427 views

netstat (/proc/net): why is user associated with socket root? how to get user-id of 'remote' process?

ubuntu 16.04 I have 2 node applications, app-1 and app-2, with usernames matching their application names, listening locally (on ports 8001 and 8002, respectively) on the same instance. When app-1 ...
0
votes
1answer
670 views

Stalled TCP connection with data in RecvQ and ESTABLISHED off

My networking skills are quite poor and I am trying to understand the following netstat -ton meaning. We have redis server and a client with a thread connecting to it via PUB/SUB. The client ...
0
votes
4answers
198 views

how to show port numbers that are listening for the incoming connections under TCPv4?

I want to use command line to show only the port numbers after ":" only This is what I'm trying to do sudo netstat -ant |grep LISTEN|grep :|sort -n|cut -c 45- It shouldn't list any tcp6 info
0
votes
0answers
1k views

can't connect to remote host with MySQL…firewall problem?

I've granted privileges to thufir for remote access through the shell (correct?), but cannot seem to actually connect. The router firewall has SPI to off. I've disable the IPv6 firewall on the ...
-1
votes
1answer
67 views

How do I get my terminal to show the entire output of my command?

terminal command: watch netstat -nalp I get an output, but I am not able to scroll down to see the majority of the output. I can only see as far down as I extend the bottom of the terminal (box). I ...
-1
votes
1answer
3k views

How to find all the incoming traffic in the linux server [closed]

How to find all the incoming traffic to the linux server. It should show only incoming traffics.
-1
votes
1answer
1k views

how to close ports with no process attachedto it

how do you close ports if there are not processes attached to it? I used to run an application and they're using this ports previously for some reason the application crashed but if i restart the ...
-1
votes
1answer
124 views

Why does atop open a raw socket?

I install atop on Debian 9. It runs as a monitoring daemon. Why is it listening on a raw socket? Raw sockets are used to generate arbitrary IPv4 packets or capture all packets read all packets for ...
-2
votes
1answer
83 views

Is a terminal emulator process a server? [duplicate]

Is a temrinal emulator process a server? If yes, what is its client(s)? How can I find out its client(s)? Thanks. netstat output contains lxterminal processes. Does that mean that a terminal ...
-3
votes
1answer
528 views

What do `0.0.0.0:*`, `[::]:mysql`, and `[::]:*` mean in netstat output?

$ sudo netstat -ap | grep postg tcp 0 0 localhost:postgresql 0.0.0.0:* LISTEN 1567/postgres udp 0 0 localhost:57504 localhost:57504 ...
-7
votes
1answer
66 views

Strange logs in Linux [closed]

I ran sudo lsof -i :80 on port 80 to check what is port 80 listening to and I got the output bellow. I dont understand what this means. It seems like some program is running on our server and using ...