Hot answers tagged

46 votes

How to interpret the output of netstat -o / netstat --timers

The timer column has two fields (from your o/p above): keepalive (6176.47/0/0) <1st field> <2nd field> The 1st field can have values: keepalive - when the keepalive timer is ON for ...
36 votes

What is ::: in the Local Address of netstat output?

As many of the other answers mention, :: represents all zeros, and then netstat may show a colon after an address, so then you get three colons. What I didn't see in any of these answers is a ...
  • 15k
19 votes

Why UDP does not show LISTENING in the state column in netstat?

As mentioned in the comments, UDP is connectionless. Unlike with TCP, it has no concept of "listening", "established", "closed", or anything like that. If a UDP port is open, it appears in the listing;...
  • 39.3k
17 votes
Accepted

How does Mac OSX prioritize network interfaces when routing?

Most systems follows these rules when choosing which route to use: Find the most specific ones (i.e. the ones with the longest matching prefix). Choose the one with the highest priority. On Linux (...
  • 2,802
15 votes

Do 0.0.0.0:0 and *:* represent the same thing?

The / refers to the subnet netmask, which is part of the IP Layer. The : refers to a port which is part of the Transport Layer. For TCP it makes sense that there is a remote end for a connection. ...
12 votes
Accepted

Do 0.0.0.0:0 and *:* represent the same thing?

It has been pointed out that my answer was in error. Since I cannot delete it, I will instead provide the correct one. The expression *:* means "Any Address, Any port". All UDP listeners will display ...
  • 34.1k
10 votes

What is the difference between nmap and netstat?

Nmap is a Network mapping tool. That means it's used to discover informations about hosts on a network (their ip, open ports, etc). Whereas Netstat is a network statistic tool used to list active ...
10 votes
Accepted

Netstat listening programs on ports alternative on Debian 9

netstat (with both options) works fine on Debian 9. If it is not installed, it is in the package net-tools. There is also the ss command (dumps socket statistics) from the package iproute2. The ...
9 votes
Accepted

Port 9001 used by Microsoft-HTTPAPI/2.0

After Daniel B comment I did the following: $ netsh http show servicestate Snapshot of HTTP service state (Server Session View): ...
8 votes

Some program occupy port 80. What is it?

Do netstat -ab to also find LISTENING state and which program. A program using your port 80 is likely a server listening on it. Or, use tcpview for GUI-based listing.
  • 842
7 votes
Accepted

Getting system lacked sufficient buffer space or because a queue was full

You are running a web server that is accessed by browsers from multiple mobile devices. Due to the way TCP/IP works, connections can not be closed immediately. Packets may arrive out of order or be ...
  • 429k
7 votes
Accepted

What does "msnbot" mean in netstat listings?

This is normal, and it does indeed correspond to a .search.msn.com address, so it's a legit Microsoft server. Your connection to it is not related to web crawlers, but many claim that it helps ...
  • 39.3k
7 votes

What is the difference between nmap and netstat?

Nmap and netstat have lots of features that are very different from each other, but there are some that are harder to distinguish. In the "obvious differences" category, netstat can: show currently-...
  • 1,858
7 votes

`netstat` command in WSL return empty list

It is a known issue that netstat does not currently work under WSL.
  • 1,137
6 votes

How to use netstat to show what process is listening on a port

I was in the process of modifying netstat on OS X to provide this feature and stumbled upon the fact that -v will give you the pid associated with a socket.
6 votes

Do 0.0.0.0:0 and *:* represent the same thing?

The difference is simply notational. Netstat in Windows uses 0.0.0.0:0 to represent an abstract idea of "any remote address and port" for a local IPv4 TCP listener and *:* for a UDP listener. For ...
6 votes

Do 0.0.0.0:0 and *:* represent the same thing?

In both cases the information is basically meaningless, but indicates more-or-less the same thing. Your first line is a TCP listen socket. The local address column indicates the address and port that ...
  • 1,202
6 votes

Powershell one-liner to show process on same line as port using netstat issue

JosefZ's answer perfectly explains your issue. You are using regex and it is doing exactly what you are asking it to do just perhaps replacing more than you expected. A side note is that you are ...
  • 1,186
5 votes

How do I kill a process that is dead but listening?

I've tried all solutions commented above and not one worked for me. I've kept researching and I got this answer, which is a combination using @Michael comment and this link https://serverfault.com/...
  • 151
5 votes

What does "msnbot" mean in netstat listings?

It is the Network Connection Broker service (NcbService) that keeps calling out. Its function is to 'allow Windows Store Apps to receive notifications from the internet'. Hit 'Win+R' > enter '...
5 votes
Accepted

Reset Netstat statistics

The netstat tool gathers statistics from various sources provided by the kernel: /proc/net/snmp /proc/net/netstat /proc/net/sctp/snmp # if used and possibly others. As these kernel data are not reset ...
  • 4,703
4 votes

How do I kill a process that is dead but listening?

saw similar issue when root cause was some child process created inheriting the ports, parent process crashed, while child process still holding the port. Resolution was to identify the child process ...
  • 141
4 votes

What is the difference between :::: and 0.0.0.0 from the netstat -an output?

:: and 0.0.0.0 have the same meaning but in completely different context. They are not the same. At the server side both are used to denote "no particular address" if you binding processes (not ...
  • 151
4 votes

How to use netstat to show what process is listening on a port

For me, the following two lines work best to show which apps have listening ports open, and tunnel, lsof is fully cross-platform: netstat -Watn | grep LISTEN lsof -Pnl +M -i -cmd | grep LISTEN
  • 234
4 votes

netstat with process name?

Here is an example for windows using FOR to parse netstat output then DO tasklist with /fi filter on pid to show process name. The last find is to remove tasklist headers. FOR /F "usebackq tokens=...
  • 139
4 votes
Accepted

Disable default VPN ports on windows 500 and 4500

You need to stop the “IKE and AuthIP IPsec Keying Modules” (short name: “IKEEXT”) service. It’ll obviously break Windows’ IPSec VPN client until you start them again.
  • 56.9k
3 votes

netstat with process name?

If you're fond of using PS, you can fork this code (note: it's super-basic) $nets = netstat -ano | select-string LISTENING foreach($n in $nets){ # make split easier PLUS make it a string instead ...
3 votes

Why does explorer.exe has an established connection to a microsoft server?

Windows connects to MS servers for many purposes, like syncing time, checking for updates, and even tiny things like displaying whether your PC has access to the internet when you mouse over the ...
  • 34.1k
3 votes
Accepted

How to use Continuously (-c) with grep on netstat?

It appears that you need to forget netstat -c and use watch instead: watch 'netstat -tap|grep http' You may want to add options to watch, including -n to set the repetition rate, and -d to highlight ...
  • 17k
3 votes
Accepted

What exactly does this netstat output mean?

When you run netstat -b: Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these ...
  • 1,490

Only top scored, non community-wiki answers of a minimum length are eligible