Networking :: Netstat Command - Huge Amounts Of Small Packets
Nov 30, 2009
I have a small office network (about 30 machine) with linux gateway (6Mbps internet bandwidth). Every user get only 500Kbps bandwidth, and they use the internet very poor. The internet getting slow lately, and I noticed that there are huge amount of small packets (78 byte, 48 byte) coming to linux machines. My question is: How can I solve which machine(s) sending those small packets? Do you have any ideas with netstat command?
Using netstat I can get a lot of network related information which is pretty useful at times. But when I use for example 'netstat -s' it gives me a lot of counts for bits transferred or data packets transferred etc. Now one thing I am not sure of is that for how long those counts will keep rolling and when will they get reset (when I restart the machine?, when I restart the network services? Or if there is some kinda threshold set on it?) How exactly netstat counts those things (I mean what is the source of those counts for netstat).
While issuing the command netstat -M it shows netstat: no support for `ip_masquerade' on this system. But this system is used as a gateway and iptable rules are set for ip forwarding. Also internet is getting another machine through this machine. What about the message?
I just found something "strange" by using netstat tcp 0 0 myhost.deprecated:53719 amaretti.chimfar.:54406 ESTABLISHED How can I check what is the program that is responsible for this line?
I've a file with a size of 6GB. I would like to compress this file and split them into smaller files. I was also thinking in use bzip2 to compress it, because if offers a good compression rate. How can I split this file into small ones to compress it?
i have a linux server runnig oracle applications. i need to access this server from putty using ssh through internet. i did by registering my static ip with the dnydns.org and i am able to connect to the server. but now there is no security to authenticate any user as any one knowing the password can login to it.
i thought of configuring the firewall of linux server but the client ip`s are not static and they change continiously. so thought of keeping one more pc between the server and the router which will do the work of authenticating. but i am confuse as how to configure it to allow the packets coming from the internet after authenticating and to by pass the packets generated from internal LAN?
I had a dream least night in which I was on my computer and I was typing the command Netstat -a in command prompt in Ms-Dos. And I was wondering why it looks so much like a Linux terminal command? This question persisted in my mind after I woke up. So what is the story about it?
When I typed netstat -lna, the output: Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:580 0.0.0.0:* LISTEN ... ...
Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State I-Node unix 2 [ ACC ] STREAM LISTENING 23581 ... ...
Can anyone explain to me: 1. What is "Active Internet connections" & "Active UNIX domain sockets"? 2. What is unix Proto? 3. Difference between LISTEN and LISTENING state.
I am running the command on a Mac but due to it being a generic unix command and a command line query.. I thought I can write on this forum.. I am running the command
Code: df -h | grep '/dev/' I get Code: /dev/disk0s2 389Gi 62Gi 327Gi 16% / /dev/disk0s3 76Gi 24Gi 52Gi 32% /Volumes/Backup /dev/disk3s2 500Gi 47Gi 453Gi 10% /Volumes/Misc Note the huge space between the 1st and 2nd Column..
This is because currently I have some NAS drives mounted which are not showing due to grep. When they are not mounted. The output is fine with equal spaces between each column (like between col 2 and 3.. or 3 and 4). I want to do a (dare I say) sed or awk or something to reduce the space between 1st and 2nd col. So that it has space like between col 3 and 4.. or 2 and 3. This is because I am showing this output somewhere and because of the space its not showing up correctly.Also I hope the command will still work when the NAS drives (afp) are not mounted.. basically consistency. The spaces are not showing properly in the quote tag. Changed it to CODE tag.
While running some live tests last week I saw an odd situation where netstat appeared to be displaying the wrong PID and process name for TCP connections. I'm trying to figure out if this is just a strange netstat bug or if it could indicate something odd is happening with our software.
We have a main program which establishes a number of connections, including connecting to a JMS server and listening/accepting a TCP connection. The main program also creates a child process which it uses to communicate with another server. On at least three occasions we saw a situation we saw netstat reporting all the expected TCP connections (correct ip/port for both source and destination), however the child process, instead of the main, was listed for the PID. The main process was still running but netstat no longer reported any TCP connections established by the main program. The main program continued to function correctly, the JMS communication continued to work and we believe the other TCP connection was functioning correctly despite the program supposedly not having any TCP connections.
I'm wondering if this could simply be a bug and/or obscure functionality of netstat that I don't understand which would cause netstat to report the child process as 'owning' the parents TCP connections. I don't know how this would happen or why the parent would continue functioning despite the problem otherwise.
I have a hardware device with two ethernet ports, eth0 and eth1 running Centos 5. Basically my goal is to forward packets from eth0->eth1 and eth1->eth0 as well as get a copy of these packets for analysis. If I set IP routing to do the forwarding then I won't get a copy of the packets for analysis.
I've been experiencing some home web-server slowdown issues lately, and I wanted to see if it's a problem with the server itself. I'm not sure if this might be the problem, but upon checking netstat -tn, I see over 15 instances of the following:
[Code]...
where 192.168.2.9 is the server's local address, the local address port varies, and the foreign address is the server's web address. If anyone knows what might be causing this and/or how to fix i
I assume that *:* means that any foreign host can connect from any port, but then what does [::]:* mean? and localhost:ipp... what port is ipp? Shouldn't ports be numeric?
I use a program which makes a large image which I have to scroll to view. The program has no way to save the image, and I have no access to the source to modify it. The only way I have to get the image from the program is by screenshot. My goal is to save the full size image without having to piece together individual screenshots. I'm using this script to try taking a screenshot:
This uses wmctrl to get the window id ($window) for a window named "Program". It then tries to resize the window to the desired dimensions. It uses imagemagick (import) to save a screenshot.png on the user's Desktop. All of this works except the resize step. I can resize the window using wmctrl -r -e, but sizes greater than the screen size don't work. I'm using Ubuntu 10.04 and the Gnome Desktop. I run two monitors, but I've tried this with one of them disabled. Is there a way to resize the window larger than my screen to get a huge screenshot?
Part II: I tried using xrandr to set up screen panning, so as to have a bigger desktop than my monitor. xrandr --output LVDS --panning 2600x2500 This command makes the laptop screen pan over a 2600x2500 size desktop, even though it can only show 1440x900 at one time. To turn off the panning, I can use a similar command to set total size and with zeroes for the panning section. This gives me back my original laptop display behavior. xrandr --fb 1440x900 --output LVDS --panning 0x0 This is all done with xrandr, and does not require any Xorg.conf changes (my Ubuntu system doesn't even have an Xorg.conf).
My video card seems to only allow about 6.5 million pixels, even though the maximum dimensions are 8192x8192. That maximum seems to be the maximum for either dimension, but there is a limit to how many pixels can be drawn, which is the width multiplied by the height. Once I did the screen resize, I tried my script again and got a screenshot. The screenshot however is totally scrambled. I'm not sure if it's unable to take a screenshot of an off-screen window or if it is unable to handle the large dimensions of the window. With the panning display, the window should think it is visible, and the window manager should think it is on-screen. So there is a pixel buffer somewhere with those pixels in it, so there should be a way to get a screenshot.
We are running a combination of Apache-2 with mod_jk connecting to tomcat workers running on separate hardware.Strange: "netstat -tn" on the Apache server outputs identical combinations of source address, source port, destination address and destination port.
Has anybody else experienced this phenomenon? (I googled and searched LQ but couldn't find anybody else reporting this)Is netstat broken, or is there another explanation?
I have a following configuration: 4 PCs (say, A, B, C and D), running Ubuntu or Debian, interconnected using a gigabit switch, which is connected to the Internet. Two machines (say, A and B) also have a direct private connection between them (provided by another pair of NICs).
Now, when I test the connection performance with iperf, the results vary. The private connection between A and B performs well - about 930Mbps using iperf's UDP test. Between C and D it is about 800Mbps which I find tolerable. Packet loss when running these tests is negligible.
However, when I run iperf between any of {A,B} and {C,D}, the performance significantly drops as there is a huge number of lost packets.
For example, here is the result of testing between A and C:
Why is there such a large number of packets which are generated, but lost somewhere?
A<->B private link works fine, so system level parameters on both A and B are correct. Furthermore, C<->D works ok, so I guess I shouldn't blame the switch.
Is there a per-NIC configuration that I should check or it smells like a hw problem? Problematic NICs on both A and B are of the same type - Allied Telesyn AT2916T.
I just installed Fedora 13 on my old compaq presario with a DLINK DWL-122 usb adapter. Both lights are on as if it were working, but network manager isn't auto connecting.
I am trying to read the /proc/net/tcp6 file of a huge server (chat server) for monitoring the tcp6 connection states.
This tcp6 file has more than 26000 lines. For monitoring the server connections, my monitoring tool has to read the /proc/net/tcp6 file quickly in regular interval. Presently it takes minimum 6-7 seconds for reading the whole file.
My tool can able to read the normal file (26,000 lines) less than 1 second, but it is not possible to read the same size of proc file.
I have 2 questions:
1) Why proc file takes more read time than normal file?
2) Is there any way to read the /proc/net/tcp6 file more quickly?
My setup is...I have a wireless access point using laptop as a gateway. The AP is also connected to a switch as is the laptop. So the laptop has two interfaces one wireless and one wired. A third device is using the AP to connect to a server on the internet. The AP sends the packets to my laptop where they are dropped. I've been looking for a solution to this problem without success. Basically is there a way for my laptop to forward all packets it sees from a certain IP address to whatever destination address they have?To clarify, my laptop is just the gateway of the AP and none of the packets are addressed to it at all, it just picks them up using a sniffer or similar tool.
