Hi,
sorry for not being too clear.
netstat can be used in order to look both for services provided by the monitored server and external services for which the server is acting as a client.
Actually netstat output reports both 'Local address' and 'Foreign address' columns: the former is for local network sockets, while the latter is for 'external' network sockets.
When I stated "
[...]You could find services provided by the server itself[...]", I meant that you could discover services for which the server is acting both as a server and as a client (trivial case: think about SSHing to the server itself).
I also didn't mention that for UDP traffic for which the server acts as a client with respect to an external service provide, you may never see a corresponding row in netstat output, because UDP connections are stateless by design (for exceptions have a look at:
networking - netstat -na : udp and state established? - Stack Overflow that is, netstat output will show UDP sockets just for services for which the server is actually acting as a server.
So, in order to see if an application is using DNS (implemented as a service listening on UDP port 53 on the server side) you'd better use a network traffic sniffing tool.
see ya
fra