Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [netstat]

netstat is a tool for viewing active network connections, listeners and sockets.

netstat is a tool for viewing active network connections, listeners and sockets.

322 questions
6
votes
2 answers

UDP port appears to be in use but is not shown in netstat or TCPView

I've encountered some strange behavior I don't understand. I'm installing software on a Windows 2003 Server. This software needs to bind to a specific UDP port an all TCP addresses in order to listen to requests. I seem to be able to bind to several…
Guillermo Prandi
  • 283
  • 3
  • 6
5
votes
1 answer

What does it mean for netstat -t

I see the help of netstat -t option says Displays the current connection offload state. And I tried it in the windows command console. The Offload State value display InHost. What does Offload means to netstat? Thanks.
Joe.wang
  • 151
  • 1
  • 4
5
votes
2 answers

After kill -9 process won't disappear and port is still bound

We have a Java server application running on Mac OS X. Occasionally this application has become unresponsive, and we have resorted to killing it with kill -9. However, the process doesn't disappear; it still appears to ps, with parentheses around…
Robert Tupelo-Schneck
  • 121
  • 1
  • 12
5
votes
3 answers

How to find full process arguments and associated listening ports?

I can execute netstat -atulpn | grep java to find all Java processes with their accompanying ports, which is great, however I would like to also have the processes full execution arguments also shown. I don't believe that this is possible with…
ylluminate
  • 1,155
  • 2
  • 17
  • 35
5
votes
3 answers

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? root@server:~# netstat -pa Connexions Internet…
Benjamin BACKX
  • 51
  • 1
  • 2
5
votes
3 answers

netstat and ip_conntrack connection count differ by order of magnitude. Why?

in /proc/net/ip_conntrack I have: established 3076 time_wait 4346 total 7468 and in netstat I have: established 1051 time_wait 73 total 1165 Why is that? Where are other connections? How to figure out what are they doing? Update: Some more stats…
Poma
  • 1,299
  • 6
  • 24
  • 35
5
votes
1 answer

Why is rpc.lockd obscured from netstat/lsof output?

Prologue: On a number of machines, which happen to act as NFS clients, netstat reports two ports that are open with no PID listed for an associated daemon. Ordinarily this might be a bit concerning. # netstat -lnp | egrep -- '- +$' tcp 0 …
Dan Carley
  • 25,617
  • 5
  • 53
  • 70
5
votes
2 answers

Early warning of port exhaustion in Linux

AFAIK, port exhaustion happens when a host is trying to establish a lot of connections to another server and the sessions used up all the available ephemeral ports. e.g. 192.168.1.1:port -> 10.20.30.40:443 This does not seem common but it is an…
some user
  • 181
  • 5
4
votes
1 answer

Network Policy Server + RADIUS not listening on any ports for Windows Server 2019

I must be missing something basic - is there some "master" switch for enabling Network Policy Server? It's not listening on any of the RADIUS ports. Detail: Trying to setup Windows Server 2019 as a RADIUS server. However, after configuring…
BlueSky
  • 141
  • 1
  • 4
4
votes
4 answers

Make a process listen on 0.0.0.0 (or not 127.0.0.1)

Both boxes in question are RHEL5. I have a python RPC server running on localhost port 8000. When a client running on the same machine tries to connect, everything works great. When a remote client attempts to connect, we get no response. netstat…
user24773
4
votes
2 answers

What causes “SYN to LISTEN sockets dropped”?

A quite busy proxy server has lots of "SYNs to LISTEN sockets dropped". I learned one cause could be a too small backlog size. But in that case the "times the listen queue of a socket overflowed" value should be equal (which it is not). So what…
edlerd
  • 826
  • 8
  • 13
4
votes
2 answers

How to know which process was using a port after it enters TIME_WAIT state?

On Linux, is there a way to figure out what process was using a port, before it went into TIME_WAIT state. When I use netstat -tnp I just see two end points, but no process information. Proto Recv-Q Send-Q Local Address Foreign Address …
user41183
  • 143
  • 1
  • 7
4
votes
2 answers

(node) Hit max file limit. Increase "ulimit -n"

In Ubuntu 9 I am receiving a message on my server that says: (node) Hit max file limit. Increase "ulimit -n" However, typing commands in the terminal reveals the following: $ ulimit unlimited $ ulimit -n 65535 And a netstat reveals I…
kidcapital
  • 847
  • 2
  • 8
  • 10
4
votes
3 answers

Windows Server 2008/2003 - determine all "used" local network ports

I have been tasked with enabling the local firewall on 100+ servers. The systems are running many different applications using many different ports. I began with an nmap scan, but without going to each system and watching the data flow (tcpdump) I…
moniker
  • 85
  • 5
4
votes
0 answers

Find the process listening on a port (not showing in lsof)

Update: The port was opened by NFS. I figured this out by configuring NFS to listen on a known port. Using Ubuntu 18.04 I want to know which process or kernel function listens on UDP port 38637. I have researched this problem and found similar…
jchook
  • 141
  • 6
1 2
3
…
21 22