0

I was trying to understand what the --numeric/-n flag of netstat does? Manual says the following about --numeric/-n

--numeric , -n

Show numerical addresses instead of trying to determine symbolic host, port or user names.

  1. Following is a line of output with "-n" option

    tcp  0  0 :::8080    :::*   LISTEN      -

  2. Following is the same line as in A but without "-n" option

    tcp  0  0 *:terabase *:*    LISTEN      -

port 8080 in my case is associated with solr. I have no idea why it's being listed as terabase. That's why I am wondering how netstat determines symbolic host. It would be helpful if someone can throw light on this.

Pang
  • 9,564
  • 146
  • 81
  • 122
Karthick
  • 2,844
  • 4
  • 34
  • 55

2 Answers2

2

You're mixing ports and hosts I believe.

The symbolic host is determined by DNS lookup, whereas the port usage is what you'll find in /etc/services (why you have teradata for port 8080 I don't know - it's usually http-alt - but go have a look)

So, for example with -n you could have

tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN

meaning something is listening on port 5432 on IP 127.0.0.1. Without -n it would be

tcp        0      0 localhost:postgresql    *:*                     LISTEN

which makes us much wiser, since we can now see it's PostgreSQL on localhost.

The price for that information is that the DNS roundtrips take time...!

Cheers,

Anders R. Bystrup
  • 15,729
  • 10
  • 59
  • 55
  • Thanks for the answer. Do you know how it looks up "program name"? is there a file for that too? Also, how is /etc/services being written and managed? Like do induvidual etc scripts write to it? – Karthick May 12 '15 at 20:31
  • In the `/proc/` filesystem – Anders R. Bystrup May 12 '15 at 20:36
  • 1
    Most of the entries in /etc/services are registered with IANA - the Internet Assigned Numbers Authority (RFC 6335). Packages and programs do not generally mess with this file. – Hankster May 12 '15 at 21:26
0

Note that you're looking at a port mapping, and not a host mapping. Port numbers are looked up in the /etc/services file, or some other database configured in /etc/nsswitch.conf

You have an entry /etc/services for terabase, mapping it to a port/protocol.

(terabase would normally be mapped to port 4000, so ether your /etc/services maps it to port 8080, or the line you're looking at is for port 4000 and not port 8080 as you assume).

nos
  • 223,662
  • 58
  • 417
  • 506