Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [netstat]

netstat is a tool for viewing active network connections, listeners and sockets.

netstat is a tool for viewing active network connections, listeners and sockets.

309 questions
275
votes
5 answers

What's the difference between IP address 0.0.0.0 and 127.0.0.1?

I know that 127.0.0.1 ~ 127.255.255.254 are the loopback IP addresses for most modern operating systems, and these IP addresses can be used to refer to our own computer. But what's 0.0.0.0? It seems it also refers to the local computer, so what's…
Jichao
  • 2,937
  • 4
  • 17
  • 14
50
votes
4 answers

How do I make cURL use keepalive from the command line?

I'm trying to verify that HTTP persistent connections are being used during communication with a Tomcat webserver I've got running. Currently, I can retrieve a resource on my server from a browser (e.g. Chrome) and verify using netstat that the…
Rob Hruska
  • 673
  • 1
  • 5
  • 10
47
votes
6 answers

How to find other end of unix socket connection?

I have a process (dbus-daemon) which has many open connection over UNIX sockets. One of these connections is fd #36: =$ ps uw -p 23284 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND depesz 23284 0.0 0.0 24680 1772 ? …
user13185
36
votes
7 answers

netstat shows a listening port with no pid but lsof does not

This question is similar to Network port open, but no process attached? I've tried everything from there, reviewed the logs, etc... and can't find anything. My netstat shows a TCP listening port and a UDP port without a pid. When I search lsof for…
mhost
  • 1,159
  • 3
  • 16
  • 25
35
votes
6 answers

Huge amount of TIME_WAIT connections says netstat

Okay, this is creeping me out - I see about 1500-2500 of these: root@wherever:# netstat Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 localhost:60930 localhost:sunrpc TIME_WAIT …
KTamas
  • 559
  • 1
  • 8
  • 15
28
votes
9 answers

How do I get rid of sockets in FIN_WAIT1 state?

I have a port that is blocked by a process I needed to kill. (a little telnet daemon that crashed). The process was killed successfully but the port is still in a 'FIN_WAIT1' state. It doesn't come out of it, the timeout for that seems to be set to…
Gert M
  • 1,471
  • 1
  • 15
  • 14
27
votes
6 answers

Network port open, but no process attached?

I have a weird situation going on with an open network port. My main question is, why would there not be a program associated with an open TCP port: netstat -ln --program Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address …
Gary Richardson
  • 1,767
  • 3
  • 19
  • 21
27
votes
5 answers

Netstat continuous refresh (watch changes the output)

I am using this simple command to monitor connections (to deal with some recent DoS attacks) on my Debian server: netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n How do I run it continuously? So it will refresh itself once…
Ruslan Osipov
  • 371
  • 1
  • 3
  • 7
22
votes
5 answers

netstat -ntap doesn't show pid/process name for some connections?

I have ubuntu/hardy server, with kernel 2.6.24-23-server and netstat: # netstat --version net-tools 1.60 netstat 1.42 (2001-04-15) The problem is that we have a lot of ESTABLISHED connections that don't show PID nor Program name in netstat -ntap…
user13185
15
votes
9 answers

Port 80 is being used by SYSTEM (PID 4), what is that?

I am trying to use port 80 for my application server, but when I perform "netstat -aon" I get TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 When I look up the process in task manager, it shows PID 4 is SYSTEM, thats it, not…
GiH
13
votes
2 answers

How to make netstat on Linux only show OUTBOUND tcp connections?

My ubuntu server is infected and there is a process making a bunch of HTTP requests to a bunch of websites (sucks!). I have added the following to my firewall (UFW): sudo ufw deny out proto tcp to any port 1:65535 To Action …
David Coch
  • 131
  • 1
  • 1
  • 5
13
votes
1 answer

Netstat hangs: why?

Sometimes (not too often at all) when I type "netstat", it takes over 5 seconds to return. While other times is instantaneous. I have been observing this for weeks on my server (CentOS 6.4), but I don't understand why!? Can anyone give an…
Daniele B
  • 357
  • 4
  • 14
13
votes
4 answers

TCP monitoring on a server: comparing netstat vs lsof?

I'm monitoring the TCP stack on a server hoping to generically infer problems with application on the box. My first inclination is to measure the number of sockets in all reported states (LISTEN,ESTABLISHED,FIN_WAIT2,TIME_WAIT, etc) and detect some…
ericslaw
  • 1,562
  • 2
  • 13
  • 15
11
votes
3 answers

How to catch DNS request using 'netstat' in Unix

I am working in a bank where 'netcat' is not there. I am having problem wherein one DNS server of the two going down is causing impact. In order to troubleshoot, I need to catch the request (incoming and outgoing) from the DNS clients (AIX). How can…
Biman Roy
  • 157
  • 1
  • 6
11
votes
2 answers

How to kill a TCP connection using tcpkill utility

I'm trying to kill an ESTABLISHED TCP connection using tcpkill. The connection is an open HTTPS connection. It appears on netstat as: tcp 0 0 X.X.X.X:55601 X.X.X.X:https ESTABLISHED So, as per the man page, I enter: $…
Charles Salvia
  • 213
  • 1
  • 2
  • 7
1
2 3
…
20 21