Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more
21 votes

Why UDP does not show LISTENING in the state column in netstat?

As mentioned in the comments, UDP is connectionless. Unlike with TCP, it has no concept of "listening", "established", "closed", or anything like that. If a UDP port is open, it appears in the listing;...
Ben N's user avatar
  • 41.1k
20 votes
Accepted

How does Mac OSX prioritize network interfaces when routing?

Most systems follows these rules when choosing which route to use: Find the most specific ones (i.e. the ones with the longest matching prefix). Choose the one with the highest priority. On Linux (...
kirelagin's user avatar
  • 2,882
15 votes

Do 0.0.0.0:0 and *:* represent the same thing?

The / refers to the subnet netmask, which is part of the IP Layer. The : refers to a port which is part of the Transport Layer. For TCP it makes sense that there is a remote end for a connection. ...
Luke Exton's user avatar
12 votes
Accepted

Do 0.0.0.0:0 and *:* represent the same thing?

It has been pointed out that my answer was in error. Since I cannot delete it, I will instead provide the correct one. The expression *:* means "Any Address, Any port". All UDP listeners will display ...
Frank Thomas's user avatar
  • 36.3k
11 votes

What is the difference between nmap and netstat?

Nmap is a Network mapping tool. That means it's used to discover informations about hosts on a network (their ip, open ports, etc). Whereas Netstat is a network statistic tool used to list active ...
tourdetour's user avatar
10 votes
Accepted

Netstat listening programs on ports alternative on Debian 9

netstat (with both options) works fine on Debian 9. If it is not installed, it is in the package net-tools. There is also the ss command (dumps socket statistics) from the package iproute2. The ...
Stefan Moch's user avatar
9 votes

`netstat` command in WSL return empty list

It is a known issue that netstat does not currently work under WSL.
OrangeDog's user avatar
  • 1,240
9 votes
Accepted

Port 9001 used by Microsoft-HTTPAPI/2.0

After Daniel B comment I did the following: $ netsh http show servicestate Snapshot of HTTP service state (Server Session View): ...
Stéphane Gerber's user avatar
8 votes
Accepted

Reset Netstat statistics

The netstat tool gathers statistics from various sources provided by the kernel: /proc/net/snmp /proc/net/netstat /proc/net/sctp/snmp # if used and possibly others. As these kernel data are not reset ...
A.B's user avatar
  • 5,956
7 votes

What is the difference between nmap and netstat?

Nmap and netstat have lots of features that are very different from each other, but there are some that are harder to distinguish. In the "obvious differences" category, netstat can: show currently-...
bonsaiviking's user avatar
  • 1,988
7 votes

Do 0.0.0.0:0 and *:* represent the same thing?

In both cases the information is basically meaningless, but indicates more-or-less the same thing. Your first line is a TCP listen socket. The local address column indicates the address and port that ...
hobbs's user avatar
  • 1,388
7 votes

Powershell one-liner to show process on same line as port using netstat issue

JosefZ's answer perfectly explains your issue. You are using regex and it is doing exactly what you are asking it to do just perhaps replacing more than you expected. A side note is that you are ...
Matt's user avatar
  • 1,236
6 votes

Do 0.0.0.0:0 and *:* represent the same thing?

The difference is simply notational. Netstat in Windows uses 0.0.0.0:0 to represent an abstract idea of "any remote address and port" for a local IPv4 TCP listener and *:* for a UDP listener. For ...
NetworkLlama's user avatar
6 votes
Accepted

How can I correctly check on what network interface SSH is listening on a Linux machine?

it speacks about a file that doesn't exist but, from my understanding I am grepping on the netstat output and not on a file No, you are in fact grepping a file named netstat. To actually run "...
grawity_u1686's user avatar
5 votes

What does "msnbot" mean in netstat listings?

It is the Network Connection Broker service (NcbService) that keeps calling out. Its function is to 'allow Windows Store Apps to receive notifications from the internet'. Hit 'Win+R' > enter '...
snubbelbuff's user avatar
5 votes

How do I kill a process that is dead but listening?

I've tried all solutions commented above and not one worked for me. I've kept researching and I got this answer, which is a combination using @Michael comment and this link https://serverfault.com/...
kato2's user avatar
  • 151
5 votes

How do I kill a process that is dead but listening?

saw similar issue when root cause was some child process created inheriting the ports, parent process crashed, while child process still holding the port. Resolution was to identify the child process ...
MSE's user avatar
  • 151
5 votes

What is the difference between :::: and 0.0.0.0 from the netstat -an output?

:: and 0.0.0.0 have the same meaning but in completely different context. They are not the same. At the server side both are used to denote "no particular address" if you binding processes (not ...
Gote Guru's user avatar
  • 161
4 votes

How to use netstat to show what process is listening on a port

For me, the following two lines work best to show which apps have listening ports open, and tunnel, lsof is fully cross-platform: netstat -Watn | grep LISTEN lsof -Pnl +M -i -cmd | grep LISTEN
Tomachi's user avatar
  • 264
4 votes

netstat with process name?

Here is an example for windows using FOR to parse netstat output then DO tasklist with /fi filter on pid to show process name. The last find is to remove tasklist headers. FOR /F "usebackq tokens=...
mark's user avatar
  • 139
4 votes

`netstat` command in WSL return empty list

Do this: alias netstat='/mnt/c/Windows/System32/netstat.exe' netstat
Mik's user avatar
  • 41
4 votes
Accepted

Listen for incoming request on port on Linux, then run command

It can be done with nc. The following snippet reads lines from the port 5000 and runs some_command if the line is token or some_other_command if the line is foo. After the client disconnects, nc is ...
Kamil Maciorowski's user avatar
3 votes

Meaning of netstat output?

How do I know it's an incoming connection from that IP, as opposed to an outgoing connection from my server to that IP? The Local Address is the address of the machine you are running the NETSTAT ...
Vomit IT - Chunky Mess Style's user avatar
3 votes

netstat with process name?

If you're fond of using PS, you can fork this code (note: it's super-basic) $nets = netstat -ano | select-string LISTENING foreach($n in $nets){ # make split easier PLUS make it a string instead ...
Erik Bitemo's user avatar
3 votes
Accepted

netstat with full command name (like in htop)

It has taken a bit of doing, but I've managed to create a filter to append the program's parameter list: netstat -p | while l="$(line)";\ do p="$(sed -En 's/^.*( [0-9]+)\/[^ ]*.*/\1/gp'<<<"...
AFH's user avatar
  • 17.6k
3 votes

What are the different parts of the response from netstat -rn

1) The expression link#x, where x is some digit, is used to indicate that the corresponding address is a link-level address, .i.e, an address that operates only on the network the host is physically ...
Itamar Zimmerman's user avatar
3 votes
Accepted

Strange entries in Netstat output

You can get more useful information from the Netstat command by adding the -f and -b parameters, like this: netstat -f -b According to the help (netstat -?) the -f switch: Displays Fully ...
I say Reinstate Monica's user avatar
3 votes
Accepted

Powershell one-liner to show process on same line as port using netstat issue

$p could be something like TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4 and $nar[-1] is string 4 so -replace operator takes all 4s: TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4 ↑↑ ↑...
JosefZ's user avatar
  • 13.3k
3 votes

`netstat` command in WSL return empty list

As OrangeDog link says, the netstat native linux does not work under WSL (v1). However in the GitHub comments there is a workaround (nice or ugly, I don't know): you can use the netstat.exe instead (I ...
рüффп's user avatar
3 votes

What application uses local address "127.0.0.1" and foreign address "screenshots"

You’re using the wrong command. Use netstat -abn | more from an administrative command prompt and it will tell you what application attached to each port, one page at a time. The -n will show IP ...
Appleoddity's user avatar
  • 11.8k

Only top scored, non community-wiki answers of a minimum length are eligible