Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [netstat]

netstat is a tool for viewing active network connections, listeners and sockets.

netstat is a tool for viewing active network connections, listeners and sockets.

322 questions
2
votes
2 answers

HTTP attack - Too many connections & TIME_WAIT

I am running CentOS 6 with http -2.2.15 Going under HTTP attack, i can see many http process running. > netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n > 1 established) > 1 Foreign > 2 LAST_ACK > 11 LISTEN > 15…
Evan Hamlet
  • 401
  • 1
  • 5
  • 6
2
votes
4 answers

How to avoid external Javascript problem hanging server?

I've been having a strange problem with externally linked Javascript libraries hanging my load balancer server running HAProxy. I recently integrated the Quantcast monitoring script, and it worked for about 12 hours, and the next morning I…
Aldie
  • 146
  • 4
2
votes
1 answer

Can't Access CouchDB Remotely

Please keep in mind that I have this installed on an Amazon EC2 instance running the latest version of Ubuntu Server. I have changed the bind_address to 0.0.0.0. netstat -an | grep 5984 yields the following: tcp 0 0 0.0.0.0:5984 …
Willem Ellis
  • 123
  • 6
2
votes
2 answers

The PID and name of the program to which socket belongs

Using 'netstat -tulp' on my server box running under CentOS I have discovered strange listening ports 33363 (TCP) and 35661 (UDP). The thing is that 'PID/Program name' field for these ports contains nothing (dash actually). 'fuser -n tcp 33363'…
user14241
  • 63
  • 3
  • 5
2
votes
2 answers

Why does netstat show Tomcat process listen to multiple ports?

The netstat output with the tomcat process(pid: 28899) is as followed: Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:8009 0.0.0.0:* LISTEN …
twimo
  • 151
  • 5
2
votes
3 answers

Too Many ESTABLISHED connection from a single IP address in Apache

netstat -ntp |grep 80 shows too many ESTABLISHED connection from single IP address. Around 300 of them and it is not an attack and user is using a 2G connection to access Apache. This is the case with other 2G connections also. As a result of…
ananthan
  • 1,510
  • 1
  • 18
  • 28
2
votes
3 answers

Unexplicated ssh connection from localhost through sshd to random localhost's port

I've tried to find out why I had some strange connections on my secure log file. Something like this : Apr 23 11:35:43 li192-61 sshd[11651]: Did not receive identification string from 127.0.0.1 Apr 23 11:35:49 li192-61 sshd[11661]: Connection closed…
alexgindre
  • 25
  • 1
  • 6
2
votes
1 answer

How to reset netstat -e counters

I would like to reset netstat -e counters. How can I do it? Renewing the network interface may reset these counters, but it is NOT an option - the networking must not be interrupted. My OS is Windows XP
Alex83
  • 21
  • 1
  • 2
2
votes
1 answer

netstat -e: high discards and errors

I think my network is congested because of the relatively large discards and errors data. They should be zero or at least close to that. Here is the output of netstat -e on my computer: Interface Statistics Received …
Mywiki Witwiki
  • 123
  • 1
  • 4
2
votes
4 answers

Netstat: How to know if it's Human or Bot/Spider/DDOS

I'm using the following command to check how many connections I have from a single ip netstat -anp |grep ':80' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n If it's DDOS attack(500+ connections), it's easy to detect. But I still have…
Crazy_Bash
  • 227
  • 1
  • 4
  • 9
2
votes
4 answers

netstat doesn't display full remote ip address, no ip address for ssl, port 443

We're running a Apache webserver on Arch Linux (build from May '10) and while monitoring connections with netstat we're seeing some odd connections on port 443 that don't report an IP address; is this cause for concern? We also don't don't get full…
scoopseven
  • 125
  • 6
2
votes
2 answers

analyse TCP performance by interpreting "netstat -s"

I have executed netstat -s on my dedicated server running debian. I'd like to interprete the results because I'm experiencing connectivity problems with TCP. I don't know how to read these results. Can anyone help please ? The context: It's a public…
Joel
  • 195
  • 2
  • 10
2
votes
2 answers

Apache many httpd process by my own server IP? eating all my Ram

Well i just bought a new dedicated server, I have no Linux experience, but i'm trying to learn. I have been testing the server for a few days. I improve the httpd.conf my.cnf for better performance, etc. I notice that my server was reaching…
ilcreatore
  • 21
  • 1
  • 3
2
votes
3 answers

netstat issue: cannot pipe output from 'netstat -c' to an nfs mount

Short version: Netstat works fine except when I redirect output to a file in NFS. doesn't work: netstat -c > /nfs/mount/file works: netstat > /nfs/mount/file works: netstat -c works: netstat -c > /tmp/file Symptoms: empty file, no error…
Buck
  • 33
  • 6
2
votes
2 answers

Linux: How to display all sockets opened for a particular interface?

How can I display all sockets opened for a particular interface?
Andrei
1 2 3
…
21 22