Questions tagged [netstat]

analysis tool for statistics about active connections, open sockets, routing tables; in general the networking subsystem.

Filter by
Sorted by
Tagged with
0 votes
0 answers
35 views

UFW port open, netstat does not show it

the result of ufw status is To Action From -- ------ ---- 22/tcp ALLOW Anywhere 80/tcp ALLOW ...
user avatar
  • 61
1 vote
1 answer
61 views

How to prevent flood of unwanted established connections - iptables

There seem to be a flood of unwanted, established port 22 connections to my server. When running sudo netstat -natup | grep 'ESTABLISHED' as root, I get a long list of unwanted established connections,...
user avatar
  • 31
2 votes
0 answers
94 views

What is listening on ports 2049, 34117 and 36105?

fadedbee@ubuntu18:~$ sudo netstat -lntp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 ...
user avatar
  • 728
1 vote
0 answers
28 views

ID process making HTTP request

My firewall is detecting my ubuntu server calling a URL on port 80 sporadically. I'd like to ID the process making the callout, but the connection is always gone by the time I can run a netstat. A lot ...
user avatar
0 votes
0 answers
69 views

strace, netstat or tcpdump to identify unknown network activity and program

I've been trying to uncover the origin of some network calls, specifically to ip addresss associated with bc.googleusercontent.com I'm a bit curious why this network activity only happens when using ...
user avatar
0 votes
0 answers
124 views

how do I interpret netstat output?

The netstat output -lt shows three localhost connections, is this ok or does it mean there are other users connected to my system? they are: domain, 2015 and 40939 Does this mean I have ports open and ...
user avatar
-4 votes
1 answer
376 views

What is the difference between route and netstat? [closed]

It seems that route and netstat return almost the same results. What is the difference between them? Why are there two commands giving redundant results? Isn't it better to consolidate the duplication ...
user avatar
0 votes
0 answers
902 views

Netstat doesn't show a process for port 53, how can I unbind the port and stop listening on it?

I am trying to install AdGuardHome but it is unable to bind to 0.0.0.0:53 because it is already being used. I tried their automated fix, as well as manually following their instructions: Deactivate ...
user avatar
4 votes
1 answer
86 views

A strange path is being printed for an entry when netstat command is used?

When I used the netstat -a command to check for active connections, I encountered this entry under active unix domains sockets(servers and established) Proto Refcnt Flags Type State ...
user avatar
0 votes
1 answer
281 views

How is 0.0.0.0:22 under the column local address of netstat command related to ip address?

I have a Ubuntu server and I connect to it from home computer using SSH. Once I connected, on the terminal of the server, netstat shows under the column "local address", 0.0.0.0:22 For example, say ...
user avatar
  • 31
0 votes
0 answers
124 views

what does mean 0.0.0.0:22 under the column local address of netstat command?

I read that 0.0.0.0:22 means that access to port 22 is allowed from any ip addresses (any other computers). However, the column "local address" of netstat only refers to ip of local addresses (local ...
user avatar
  • 31
3 votes
2 answers
503 views

Difference between netstat and ss and how to convert commands?

what's the equivalent using ss command ? netstat -antp netstat -lntp what's the difference if we use ss with no hyphen and with ss -a ? what does this command do for us ss -antlp ?
user avatar
  • 57
7 votes
3 answers
21k views

What does the -tulpn option mean for netstat?

For finding out which ports of the machine are being opening by which services, I used: netstat -tulpn I checked the man page for netstat command, but I found nothing about this option. What's the ...
user avatar
3 votes
1 answer
3k views

Strange output for netstat command

I'm getting a strange output for the netstat -tup. What I mean by strange is I never got this output before when nothing connected to the network/internet (connected to the network, but not using it, ...
user avatar
  • 31
-1 votes
1 answer
216 views

Hide Real IP - Ubuntu

Can i hide the real IP of my machine in "netstat -n"? Perhaps using the iptables masquerade function? (When the user is logged into the application and runs the netstat -n command, he can view the ...
user avatar
  • 1
1 vote
1 answer
169 views

Something blocking port 80

So I'm trying to get Apache to run on AWS server again and I'm running into this error: (98)Address already in use: AH00073: make_sock: unable to listen for connections on address [::]:80 (98)Address ...
user avatar
  • 11
1 vote
0 answers
264 views

Need to set default route to upstream DHCP interface on Ubuntu Server 18.04 LTS

I'm building an edge router using Ubuntu Server 18.04.03 LTS and need to configure the routing table to define the default route as being the upstream / WAN interface, which gets its IP address and (...
user avatar
  • 311
1 vote
1 answer
186 views

kdeconncted connections?

I have a number of Ubuntu Bionic hosts on a network. I noticed a connection between two of them (in netstat) that showed a connection between two of the hosts. In syslog, I see that it's seeking out ...
user avatar
  • 151
0 votes
1 answer
879 views

How to see the address dnsmasq is listening to without netstat

I used to run sudo netstat -tulpen | grep dnsmasq, but netstat is outdated. This answer says to use ss as an alternative, but I cannot get the desired output. I.e. ss -ltu | grep dnsmasq does not ...
user avatar
  • 103
1 vote
2 answers
2k views

netstat command on WSL doesn't give any messages

$ netstat -nap (No info could be read for "-p": geteuid()=1000 but you should be root.) Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign ...
user avatar
  • 137
0 votes
1 answer
921 views

What does Netstat -tlnp mean and do

What does netstat -tlnp do and mean? I have read the man pages for netstat however can only find a answer for -l not the other options
user avatar
  • 375
1 vote
1 answer
127 views

What PID/program is this?

I ran the netstat command and I got a program with PID/program description as 3061/host. The protocol was udp. The local address was 0.0.0.0:37089. The foreign address was 0.0.0.0:* Is ...
user avatar
1 vote
0 answers
30 views

Get Network status for each interface separately

I'm trying to get statistics for each interface (NIC)and protocol separately, I know about nstat and netstats but they give me all interfaces and protocols statics together, is there any way to get ...
user avatar
0 votes
1 answer
897 views

ssh connection refused; netstat LISTEN; nmap closed

My Setup Ubuntu server 18.04 on local hardware A laptop from which I want to ssh into the server over local network My Problem Every once in a while right after boot, I can ssh into the machine ...
user avatar
0 votes
2 answers
237 views

I am trying to find out if someone is running a server on my Ubuntu without my knowledge

I know this sounds a bit odd. But I have been having hacking done on my computer and I am locked out of my "su" user now for some reason. My computer cpu is running abnormally high and I think there ...
user avatar
1 vote
0 answers
197 views

Glassfish - MongoDB - Too many open files

I am having a backend deployment running on a glassfish server, the frontend of my application sends REST request when it needs some data. Also the backend is connected to a mongo database: ...
user avatar
1 vote
0 answers
416 views

OpenSuSE removed netstat and ifconfig. What are the plans for ubuntu?

OpenSuSE removed netstat and ifconfig. What are the plans for Ubuntu? Will Ubuntu remove these commands, too?
user avatar
  • 2,304
22 votes
3 answers
30k views

has netstat been replaced with a new tool?

Has netstat been replaced by a newer program? I noticed netstat is part of the nettools package which was replaced by ip command. What program should i be using to check see open/listening ports on ...
user avatar
  • 425
0 votes
1 answer
215 views

Ubuntu 17.10 with two NICs: routing requests to correct NIC

I have done a bunch of searches about this, and found a lot of answers that don't quite seem to fit my question. If this question has been answered already, I apologize. My PC has Ubuntu 17.10, and ...
user avatar
  • 1
10 votes
1 answer
25k views

How to show listening ports and TCP connections to the ports

Does anyone know what exact netstat commands in Ubuntu Server to use to show: Ports listening on on the server Current TCP connections to those ports
user avatar
  • 133
0 votes
2 answers
325 views

checking established ports

Is the command which I am using is wrong to check a port is established or not? count=$(netstat -an | awk '$4 ~ /:'"$PORT"'$/ && $6 == "ESTABLISHED" {print $0}'| wc -l) And taking the $count ...
user avatar
  • 743
3 votes
1 answer
4k views

What does 'unix 3 [] STREAM CONNECTED 438037 29037/python' mean?

I'm using netstat to monitor my Ubuntu server and I've found things as below: tcp 1 0 localhost:48604 localhost:11311 CLOSE WAIT 29511/st atic transf tcp 0 0 ...
user avatar
  • 1,168
0 votes
0 answers
206 views

How to list processes communicating with the Internet

I'm trying to detect if my target processes are communicating with the Internet. Here is what I edit my script named test.sh: a=$(pgrep -f $1) a=$(echo $a | sed -e 's/ /\\|/g') a="'${a}'" cmd="...
user avatar
  • 1,168
0 votes
1 answer
2k views

Why shows netstat an entry for ipv6 although it 's already disabled?

I've disabled ipv6 according to the description in: http://askubuntu.com/a/484487/229026, (As far I know, this article should also apply to Ubuntu 16.04) but netstat -nautp is still displaying the ...
user avatar
  • 1,017
0 votes
1 answer
250 views

What does `netstat -antupe` mean?

What does the command netstat -antupe actually mean? I understand that netstat is used to view the status of the Network but what does the -antupe flag do?
user avatar
-1 votes
1 answer
2k views

Open ports - Netstat

I am running these commands to get a list of all open ports on my Ubuntu 16 server. I was wondering why ports 1-25 appear to be open? Is this a security risk or is this normal for an Ubuntu server? ...
user avatar
  • 135
0 votes
1 answer
1k views

Can I use `netstat` to find adware, spyware, malware or ransomware?

First off I ran netstat -a to list all but it's 1,000 lines of 80+ chars / line and won't fit into a question. So I narrowed it down to netstat -l -e to list connections that are "listening" to my ...
user avatar
0 votes
2 answers
2k views

How to auto ban an IP when he access some ports?

I have a vps, which host some service only I used. Today, I found someone scaning my vps by netstat -ntu | awk '{print $5}' |sort | uniq -c | sort -n And found some result(I have removed my ip from ...
user avatar
  • 1,851
0 votes
1 answer
1k views

netstat distinct values

how can I check netstats on ubuntu for a specific port? example netstat -? grep: 80 but with a twist so it does this as well it should show only distinct ip addresses but any duplicated ip ...
user avatar
  • 1
1 vote
1 answer
996 views

A more efficient way to sort the result of netstat command

I was trying to sort only the IP addresses not related to firefox and write them in a file. I ended up with this command line, did the job but I am wondering if there is a way to do better. netstat -...
user avatar
0 votes
1 answer
188 views

How to get information out of netstat's results

I wanted to know the servers behind my connections and with a browser closed this is the result of my netstat command. tcp 0 0 xxx.xxx.xxx.xxx:xxxxx ec2-54-229-105-92:https TIME_WAIT ...
user avatar
  • 583
0 votes
1 answer
288 views

What is netstat -r command used for?What does the different flags mean: MSS, window, etc [closed]

What does the different flags mean: MSS, window, etc
user avatar
3 votes
2 answers
9k views

Linphone: could not start tls transport on port 5060, maybe this port is already used?

update: Probably this is because of NAT, although that might an Ekiga specific problem. I've tried multiple clients on this machine, cannot get any SIP clients to work for me. On the same network, ...
user avatar
  • 4,343
2 votes
1 answer
11k views

Using Nmap to port scan [closed]

I'm trying out Nmap and have encountered a problem. Before anything, I would like to tell you that I am using this on my own laptops at home :) When I use Nmap <target_IPAddress> it shows me ...
user avatar
0 votes
0 answers
2k views

netstat not listing apache IPv4 listen sockets

My apache is listening for *.80 and *.443 connections. And it works fine: ** root@syslog-ng ** /etc ** Mon Nov 07 13:33:51 # telnet 127.0.0.1 80 Trying 127.0.0.1... Connected to localhost. Escape ...
user avatar
  • 213
4 votes
2 answers
9k views

Format of IPv6 addresses in the netstat output

When I use netstat -n, it won't display the whole IPv6 addresses. The local ip address is in this format xxxx:xxxx:xxxx:xxxx:portNum, so just a part of the address is displayed. Also the foreign ...
user avatar
  • 43
0 votes
1 answer
2k views

Bind port on external ip

I would like to bind my 3306 port on 0.0.0.0. Actually when I do : netstat -an | grep 3306 It returns : tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN How can I do ...
user avatar
  • 3
2 votes
1 answer
3k views

Is ipv6 disabled or not

I tried to completely disable IPv6 on my Ubuntu 14.04 according to this post But netstat shows it is in use. Why? ~ > sudo sysctl -p|grep ipv6 net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf....
user avatar
  • 2,293
106 votes
3 answers
150k views

netstat or alternative in docker ubuntu server 16.04 container

Was netstat removed in 16.04? Is there an alternative to netstat available in 16.04? Or how do I install netstat in 16.04? I am running an ubuntu:16.04 container in docker for Windows, it seems that ...
user avatar
0 votes
0 answers
134 views

How to change/forward IP:Port mapping

I have a application that binds to 127.0.0.1:9000. I can't access from other nodes on the network due to this. I want it to appear as my-machine-name:9000 instead. How can I do this in Ubuntu. ...
user avatar
  • 101