Netstat | Unix Linux Forums | IP Networking

  Go Back    


IP Networking Learn TCP/IP, Internet Protocol, Routing, Routers, Network protocols in this UNIX and Linux forum.

Netstat

IP Networking


Closed Thread    
 
Thread Tools Search this Thread Display Modes
    #1  
Old 10-01-2001
DPAI's Avatar
DPAI DPAI is offline
Registered User
 
Join Date: Jul 2001
Last Activity: 23 June 2005, 11:36 AM EDT
Posts: 112
Thanks: 0
Thanked 0 Times in 0 Posts
Netstat

Giving netstat command on the prompt gives commands such as
localhost.43592 localhost.35237 32768 0 32768 0 TIME_WAIT
localhost.43594 localhost.43595 32768 0 32768 0 TIME_WAIT
localhost.43598 localhost.35237 32768 0 32768 0 TIME_WAIT
localhost.43600 localhost.43601 32768 0 32768 0 TIME_WAIT
localhost.43604 localhost.35237 32768 0 32768 0 ESTABLISHED
localhost.35237 localhost.43604 32768 0 32768 0 ESTABLISHED
loc...etc

What are these connections anyway ....
How do i know wat these ports are doin .....
Will closing these ports do any harm
Sponsored Links
    #2  
Old 10-01-2001
Perderabo's Avatar
Perderabo Perderabo is offline Forum Staff  
Unix Daemon (Administrator Emeritus)
 
Join Date: Aug 2001
Last Activity: 22 September 2014, 3:12 PM EDT
Location: Ashburn, Virginia
Posts: 9,925
Thanks: 60
Thanked 435 Times in 260 Posts
The ESTABLISHED sockets have a process at each end and they are communicating. Eventually the processes will invoke close(2) or shutdown(2) on the sockets and they will go away. You could also kill the processes and the exit(2) system call will close them.

When a socket completely closes, it will enter TIME_WAIT for awhile before it disappears. In your case you have two processes talking on the same host. Usually there would be two different hosts with a network connecting them. It is possible for packets to have been lost in transit. Such packets could arrive late, even after the socket has closed. If a packet arrives for a socket in TIME_WAIT, it is discarded. If you somehow discarded a socket in TIME_WAIT, you lose that protection. The socket could be reused and it will freak when any lost packets from the previous connection arrive. TIME_WAIT sockets should not last very long.
Sponsored Links
    #3  
Old 10-01-2001
Neo's Avatar
Neo Neo is offline Forum Staff  
Administrator
 
Join Date: Sep 2000
Last Activity: 22 September 2014, 3:00 PM EDT
Location: Asia pacific region
Posts: 13,022
Thanks: 521
Thanked 875 Times in 402 Posts
AND.....

Sockets are established by processes. What the 'sockets are doing' (as you ask) depends on what processes the platform is running. Sometimes this is easy to know, when the server-side sockets are 'well known sockets' and the usage is standard. Sometimes, finding out what processes are using which sockets can involve some real detective work.
    #4  
Old 10-01-2001
Perderabo's Avatar
Perderabo Perderabo is offline Forum Staff  
Unix Daemon (Administrator Emeritus)
 
Join Date: Aug 2001
Last Activity: 22 September 2014, 3:12 PM EDT
Location: Ashburn, Virginia
Posts: 9,925
Thanks: 60
Thanked 435 Times in 260 Posts
There is a cool freeware program called lsof. While it can't tell you exactly what a socket is doing, it can at least display the pid of the process which is using it. So if one or more sockets are using, say, port 43492 on the local side, "lsof -i :43492" will show which processes are using them (or it).
Sponsored Links
    #5  
Old 10-01-2001
Andy Hibbins Andy Hibbins is offline
Registered User
 
Join Date: Jun 2001
Last Activity: 25 July 2003, 6:58 PM EDT
Location: Leicestershire, UK
Posts: 92
Thanks: 0
Thanked 1 Time in 1 Post
Another cool program is iptraf, this program monitors specified network interfaces and can give a detailed breakdown of network traffic.

Stats such as bytes/s packets/s packet sizes etc can be shown for mac addresses, ports, ipaddresses.

iptraf can run in interative mode or in the background and send data to a user specified log file.

cebu.mozcom.com/riker/iptraf/


Andy H
Sponsored Links
    #6  
Old 10-01-2001
loadc loadc is offline
Registered User
 
Join Date: Sep 2001
Last Activity: 16 December 2002, 4:51 PM EST
Posts: 40
Thanks: 0
Thanked 0 Times in 0 Posts
Lessee here....

You asked what the connections are:

the first poster answered that as well as I could, they are the connections to and fromyour box, the last column is the state of the "socket" (connection). these are FASCINATING things, and it always pays to know about them, Sys Admin did an excellent article this last year on socket states, look it up at their site, www.sysadminmag.com, I think

You also asked about knowing what the ports are doing:

again, the other posters covered this extremely well, lsof and ps are your friends here, as well as teh iptraf command, do a man on any or all of them and if you don't have lsof, I suggest getting it, it is very useful. You could also turn on promiscuous (?) mode on your interface with tcpdump/etherpeek/snoop/any other packet dumper, and look to see what is coming in, that is an education in networking in itself. Do a man on tcpdump, and you can learn more about ip traffic than you thought existed.

You also asked if closing the ports will do any harm:

That depends, are you connected on the port via telnet to your remote machine? If so, it would kill that session, you could also kill mail, and many other helpful connections to your machine, not to mention any servers listening on ports (these will be in a state of LISTEN).

Now, some also mentioned that you have to wait for a length of time before you can see the port be released and may reuse it again. this is true, but it is also usually a kernel parm taht is settable and can be cranked down to 5 seconds (or less on some platforms), be CAREFUL with this, it is dangerous to set your timeouts so low.....
Noe there is also an interactive way to kill these ports and NOT wait, WITHOUT the kernel parm; Dugsong put out a tool a while back called dsniff, it is a suite of some really wicked tools he used to figure out some networking things on his own system. There are some amazing things in there. One of the tools is tcpkill, it allows you to kill a socket on the localhost and NOT timeout the port, it just goes AWAY... very good programming...
He has made this available in the *BSD ports and packages, as well as at his site, which is quite interesting (when he isn't censoring it due to the DMCA...
www.monkey.org/~dugsong/dsniff.html ought to get you there. I will warn you, this tool is very dangerous in the wrong hands, it was intended for learning and should be used with the respect due to it and it's author. Using it illegally would endanger eveyone else's access to it, not only your own, so think of others and use it wisely and respectfully... please.


Ciao


loadc
Sponsored Links
    #7  
Old 10-02-2001
DPAI's Avatar
DPAI DPAI is offline
Registered User
 
Join Date: Jul 2001
Last Activity: 23 June 2005, 11:36 AM EDT
Posts: 112
Thanks: 0
Thanked 0 Times in 0 Posts
Thanx Posters,
That was great stuff .....
Sponsored Links
Closed Thread

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
Netstat(8) on CentOS? coolcalin812 UNIX for Dummies Questions & Answers 1 05-10-2011 05:47 AM
netstat -- what am i looking at? Harleyrci Solaris 3 10-28-2010 08:43 PM
netstat -anp iga3725 AIX 2 07-22-2010 11:37 AM
netstat axes IP Networking 3 05-21-2006 10:50 AM
Netstat msg kymberm IP Networking 2 02-24-2003 12:00 PM



All times are GMT -4. The time now is 06:16 PM.