I just found something "strange" by using netstat
tcp 0 0 myhost.deprecated:53719 amaretti.chimfar.:54406 ESTABLISHED
How can I check what is the program that is responsible for this line?
While issuing the command netstat -M it shows netstat: no support for `ip_masquerade' on this system. But this system is used as a gateway and iptable rules are set for ip forwarding. Also internet is getting another machine through this machine. What about the message?
View 3 Replies View RelatedI have a small office network (about 30 machine) with linux gateway (6Mbps internet bandwidth). Every user get only 500Kbps bandwidth, and they use the internet very poor. The internet getting slow lately, and I noticed that there are huge amount of small packets (78 byte, 48 byte) coming to linux machines. My question is: How can I solve which machine(s) sending those small packets? Do you have any ideas with netstat command?
View 1 Replies View RelatedI had a dream least night in which I was on my computer and I was typing the command Netstat -a in command prompt in Ms-Dos. And I was wondering why it looks so much like a Linux terminal command? This question persisted in my mind after I woke up. So what is the story about it?
View 3 Replies View RelatedWhen I run "netstat -a" commnand, it display:
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 20269 /tmp/.gdm_socket
...
unix 2 [ ] DGRAM 997161
unix 3 [ ] STREAM CONNECTED 942628 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 942627
unix 3 [ ] STREAM CONNECTED 942626 /tmp/.X11-unix/X0 ....
Why some socket don't have Path name? And what mean's RefCnt = 2?
Whats the proper netstat command to see if Apache hit the MaxClient setting?
View 1 Replies View RelatedWhen I typed netstat -lna, the output:
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:580 0.0.0.0:* LISTEN
...
...
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node
unix 2 [ ACC ] STREAM LISTENING 23581
...
...
Can anyone explain to me:
1. What is "Active Internet connections" & "Active UNIX domain sockets"?
2. What is unix Proto?
3. Difference between LISTEN and LISTENING state.
We are having an issue with our application where once we start making a few hundred connections to our Linux server, our connections are staying in the established state. When our app is working fine, the client sends a basically a heartbeat every five minutes. It is all nice and clean, receives the FIN and shuts down and that's that. tcpdump as follows:
Code:
12:53:10.965206 IP serverA.xxx.xxx.com.40315 > serverB.xxx.xxx.com.1234: . ack 2 win 46 <nop,nop,timestamp 3299017001 2043788445>
12:58:10.892878 IP serverA.xxx.xxx.com.40322 > serverB.xxx.xxx.com.1234: S 494392992:494392992(0) win 5840 <mss 1460,sackOK,timestamp 3299316941 0,nop,wscale 7>
12:58:10.894882 IP serverA.xxx.xxx.com.40322 > serverB.xxx.xxx.com.1234: . ack 3318963465 win 46 <nop,nop,timestamp 3299316941 2044088355>
12:58:10.894886 IP serverA.xxx.xxx.com.40322 > serverB.xxx.xxx.com.1234: P 0:78(78) ack 1 win 46 <nop,nop,timestamp 3299316941 2044088355> .....
Then things start getting busy, and it ends up looking like this:
Code:
01:28:10.493760 IP serverA.xxx.xxx.com.41132 > serverB.xxx.xxx.com.1234: S 774853781:774853781(0) win 5840 <mss 1460,sackOK,timestamp 3344315513 0,nop,wscale 7>
01:28:13.491231 IP serverA.xxx.xxx.com.41132 > serverB.xxx.xxx.com.1234: S 774853781:774853781(0) win 5840 <mss 1460,sackOK,timestamp 3344318513 0,nop,wscale 7>
01:28:13.491755 IP serverA.xxx.xxx.com.41132 > serverB.xxx.xxx.com.1234: . ack 3597595480 win 46 <nop,nop,timestamp 3344318513 2089089105> ....
What could be the cause if the fin was received at 01:28:13.492743, but hours later this connection is still established:
gateway 16514 root 111u IPv4 2714750 TCP
serverB.xxx.xxx.com:1234->serverA.xxx.xxx.com:41132 (Established)
There is no corresponding connection in the client's netstat.
I've seen packets coming to my computer through a DD-WRTv24s2 gateway above port 32K several times. I have iptables (using fwbuilder locally) both places. My desktop stops the packets. But I'm guessing the problem is as I described in the title for this post. Yes?If you ESTABLISH a connection to some webpage, and you just accept ESTABLISHED or RELATED datagrams in rule 1 of your iptables, what will keep incoming TCP from that (presumably nefarious) site from going straight to your desktop like the building firewall isn't there?? If the site wants to connect to you above 32k, or portscan you, its RELATED correct? They know your IP. You've ESTABLISHED a connection.If my guess is correct, it would seem wiser to NEVER use these together. Better to ACCEPT all ESTABLISHED. And if something is RELATED, then ACCEPT it only if its the data connection on FTP or individually by service or protocol.
View 6 Replies View RelatedI was wondering, on a GNU/Linux system including but not limited to *ubuntu, how would I go about determining when the network connection is established on any interface, so I can run a shell script only once at that exact time?The idea that comes to mind is polling-and-sleeping, but I'd like to know if there is another, more robust way? Like an onconnectionestablished javascript event or something.
View 2 Replies View RelatedI have question regarding netstat? When performing a "netstat -s" I receive the following information regarding dropped packets under IP:
IP:
93978695 total packets received
0 forwarded
0 incoming packets discarded
79472157 incoming packets delivered
65235033 requests sent out
29527 outgoing packets dropped
However if I run a "netstat -i" I have no dropped packets whatsoever: (apologies for the table format):
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
bond0 1500 0 34326528 0 0 0 72755307 0 0 0 BMmRU
bond0:1 1500 0 - no statistics available - BMmRU
bond1 1500 0 28605491 0 0 0 20948952 0 0 0 BMmRU
eth0 1500 0 34199550 0 0 0 72755278 0 0 0 BMsRU
eth1 1500 0 126978 0 0 0 29 0 0 0 BMsRU
eth2 1500 0 97911 0 0 0 1 0 0 0 BMsRU
eth3 1500 0 28507580 0 0 0 20948951 0 0 0 BMsRU
lo 16436 0 34094225 0 0 0 34094225 0 0 0 LRU
I have an application that uses port 8080 all the time. One time, for some reason, it was taken by I didn't know what.
View 2 Replies View Relatedthere is an open wireless i can connect it -in ubuntu- but can not browse anything.we tried to connect via mobile it's working fine ,in addition via Windows XP it's fine ,but not in ubuntu why???!!
View 1 Replies View RelatedWhile running some live tests last week I saw an odd situation where netstat appeared to be displaying the wrong PID and process name for TCP connections. I'm trying to figure out if this is just a strange netstat bug or if it could indicate something odd is happening with our software.
We have a main program which establishes a number of connections, including connecting to a JMS server and listening/accepting a TCP connection. The main program also creates a child process which it uses to communicate with another server. On at least three occasions we saw a situation we saw netstat reporting all the expected TCP connections (correct ip/port for both source and destination), however the child process, instead of the main, was listed for the PID. The main process was still running but netstat no longer reported any TCP connections established by the main program. The main program continued to function correctly, the JMS communication continued to work and we believe the other TCP connection was functioning correctly despite the program supposedly not having any TCP connections.
I'm wondering if this could simply be a bug and/or obscure functionality of netstat that I don't understand which would cause netstat to report the child process as 'owning' the parents TCP connections. I don't know how this would happen or why the parent would continue functioning despite the problem otherwise.
with netstat i found a port with idle state, i google the meaning of IDLE:Idle, opened but not bound.What do you mean by bound?
View 2 Replies View RelatedWhen the centos is running a vpn server, there 's a client connecting. The connection can't be seen by netstat -tunp
View 4 Replies View RelatedI want a program (shell script) to be executed as soon as my DHCP connection is established successfully. Is there any way I can do this ?
View 2 Replies View RelatedI have received a new modem from my provider and installed it. No problem with that except that there is a problem with my internetconnection. The internetconnection is established.But my computer gives an error every time I want to visit a website:
View 4 Replies View RelatedI bought my new Dell inspiron N1401 64bit laptop. It has windows 7 installed in it, I am begineer to linux. I have installed Ubuntu 11.04 64 bit version. I have a wired internet connection which works fine with my windows 7. When I switch to Ubuntu, when internet cable is plugged, the top right corner, network manager shows connection is established, but when I open firefox I cannot access internet. I tried searching on forums, but I could not make it work. If I type ifconfig command in terminal attached is the output I get, I dont know what is the problem. I want to use Ubuntu than Windows
View 2 Replies View RelatedI need the port 27015 to be open. I've opened it in iptables :
Quote:
iptables -A INPUT -p tcp -i eth0 --dport 27015 -j
But when i try :
Quote:
netstat -nan
The port 27015 do not appear as "LISTEN".
I've been experiencing some home web-server slowdown issues lately, and I wanted to see if it's a problem with the server itself. I'm not sure if this might be the problem, but upon checking netstat -tn, I see over 15 instances of the following:
[Code]...
where 192.168.2.9 is the server's local address, the local address port varies, and the foreign address is the server's web address. If anyone knows what might be causing this and/or how to fix i
Netstat has always confused me. I ype netstat -pl and get this:
Code:
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 localhost:ipp *:* LISTEN 1476/cupsd
tcp 0 0 localhost:postgresql *:* LISTEN 13816/postgres
tcp 0 0 *:44223 *:* LISTEN 1288/sshd
tcp6 0 0 localhost:ipp [::]:* LISTEN 1476/cupsd
tcp6 0 0 localhost:postgresql [::]:* LISTEN 13816/postgres
tcp6 0 0 [::]:44223 [::]:* LISTEN 1288/sshd
udp 0 0 *:bootpc *:* 1267/dhclient
I assume that *:* means that any foreign host can connect from any port, but then what does [::]:* mean? and localhost:ipp... what port is ipp? Shouldn't ports be numeric?
I see something like internet connection is established. Ive established etho connection but I cant open any sites at all. I also have Windows on another hard disk and it works well. About a week ago I had Ubuntu 8.04 and it worked really fine. What�s wrong? Is there any remedy?
View 3 Replies View RelatedI have created the following script
Code:
#!/bin/sh
interface=`ifconfig | grep -iE "(wlan0|gprs0)" | awk '{print $1}'`
[code]...
Using netstat I can get a lot of network related information which is pretty useful at times. But when I use for example 'netstat -s' it gives me a lot of counts for bits transferred or data packets transferred etc. Now one thing I am not sure of is that for how long those counts will keep rolling and when will they get reset (when I restart the machine?, when I restart the network services? Or if there is some kinda threshold set on it?) How exactly netstat counts those things (I mean what is the source of those counts for netstat).
View 2 Replies View RelatedWe are running a combination of Apache-2 with mod_jk connecting to tomcat workers running on separate hardware.Strange: "netstat -tn" on the Apache server outputs identical combinations of source address, source port, destination address and destination port.
Has anybody else experienced this phenomenon? (I googled and searched LQ but couldn't find anybody else reporting this)Is netstat broken, or is there another explanation?
I am trying to connect to a windows 2000 VPN server at work, with my current settings in DOES connect to the VPN and i can ping the domain server which is 10.1.1.2 but the first issue is i cannot ping the other computers on the network(via hostnames) can't remember the ip address of the other machines . second issue is when the connection is established and i RDP into 10.1.1.2 ok great i am connected to the server but any interaction in the RDP session even moving the mouse on the screen kills the session and the VPN connection fails.
Running Ubuntu 10.04 LTS 64Bit
Image of current settings in network manager:
Syslog:
Code:
May 11 12:08:04 oliver-desktop NetworkManager: <info> Starting VPN service 'org.freedesktop.NetworkManager.pptp'...
May 11 12:08:04 oliver-desktop NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.pptp' started
[Code].....
Ubuntu 11.04, wireless adapter BCM4312.The connection works for a while, for a random length of time from a few minutes to a few hours, then stops working. The laptop says it's connected, and the router says it's connected, but the browser can't find any Web pages, it can't find the router, and there is no response to pings from the router or any other device on the local network or on the Internet. "Host unreachable." When I try to ping to the laptop from another one, it times out.If I shut down the computer and try again a few hours later, it works fine again for a while, then after a while it stops working again.
In case it's relevant, sometimes when I restart networking from the command line, it says "ignoring unknown interface eth1=eth1," even though ifconfig -a lists eth1 as up with an ip address. eth1 is the wireless adapter. Another laptop with Ubuntu 11.04 connects to the same router with no problems.Using a fixed IP address doesn't change anything.
My wired network dead which i used before 1hr. I seen my firestar firewall application blocked a hit from my internet provider gateway address. I allowed all the connection from my provider gateway after that hit. It did not work. I installed a new OS ubuntu 10.04 tls. and assigned the IP address but still I cant acess the internet. It says connection was established but i cant browse net. Some one pls help me. I tried configuring fire fox. no use.I am using Internet dish. I configure it by browser by entering dish IP.
View 9 Replies View RelatedHow to reset (clear) statistics for the "netstat -s"?
View 1 Replies View Related