46
votes
How to interpret the output of netstat -o / netstat --timers
The timer column has two fields (from your o/p above):
keepalive (6176.47/0/0)
<1st field> <2nd field>
The 1st field can have values:
keepalive - when the keepalive timer is ON for ...
- 561
36
votes
What is ::: in the Local Address of netstat output?
As many of the other answers mention, :: represents all zeros, and then netstat may show a colon after an address, so then you get three colons.
What I didn't see in any of these answers is a ...
- 15k
19
votes
Why UDP does not show LISTENING in the state column in netstat?
As mentioned in the comments, UDP is connectionless. Unlike with TCP, it has no concept of "listening", "established", "closed", or anything like that. If a UDP port is open, it appears in the listing;...
- 39.3k
17
votes
Accepted
How does Mac OSX prioritize network interfaces when routing?
Most systems follows these rules when choosing which route to use:
Find the most specific ones (i.e. the ones with the longest matching prefix).
Choose the one with the highest priority.
On Linux (...
- 2,802
15
votes
Do 0.0.0.0:0 and *:* represent the same thing?
The / refers to the subnet netmask, which is part of the IP Layer.
The : refers to a port which is part of the Transport Layer.
For TCP it makes sense that there is a remote end for a connection.
...
- 271
12
votes
Accepted
Do 0.0.0.0:0 and *:* represent the same thing?
It has been pointed out that my answer was in error. Since I cannot delete it, I will instead provide the correct one.
The expression *:* means "Any Address, Any port". All UDP listeners will display ...
- 34.1k
10
votes
What is the difference between nmap and netstat?
Nmap is a Network mapping tool. That means it's used to discover informations about hosts on a network (their ip, open ports, etc). Whereas Netstat is a network statistic tool used to list active ...
- 353
10
votes
Accepted
Netstat listening programs on ports alternative on Debian 9
netstat (with both options) works fine on Debian 9. If it is not installed, it is in the package net-tools.
There is also the ss command (dumps socket statistics) from the package iproute2. The ...
- 170
9
votes
Accepted
Port 9001 used by Microsoft-HTTPAPI/2.0
After Daniel B comment I did the following:
$ netsh http show servicestate
Snapshot of HTTP service state (Server Session View): ...
- 290
8
votes
Some program occupy port 80. What is it?
Do netstat -ab to also find LISTENING state and which program. A program using your port 80 is likely a server listening on it. Or, use tcpview for GUI-based listing.
- 842
7
votes
Accepted
Getting system lacked sufficient buffer space or because a queue was full
You are running a web server that is accessed by browsers from multiple mobile devices.
Due to the way TCP/IP works, connections can not be closed immediately. Packets may arrive out of order or be ...
- 429k
7
votes
Accepted
What does "msnbot" mean in netstat listings?
This is normal, and it does indeed correspond to a .search.msn.com address, so it's a legit Microsoft server. Your connection to it is not related to web crawlers, but many claim that it helps ...
- 39.3k
7
votes
What is the difference between nmap and netstat?
Nmap and netstat have lots of features that are very different from each other, but there are some that are harder to distinguish. In the "obvious differences" category, netstat can:
show currently-...
- 1,858
7
votes
`netstat` command in WSL return empty list
It is a known issue that netstat does not currently work under WSL.
- 1,137
6
votes
How to use netstat to show what process is listening on a port
I was in the process of modifying netstat on OS X to provide this feature and stumbled upon the fact that -v will give you the pid associated with a socket.
- 161
6
votes
Do 0.0.0.0:0 and *:* represent the same thing?
The difference is simply notational.
Netstat in Windows uses 0.0.0.0:0 to represent an abstract idea of "any remote address and port" for a local IPv4 TCP listener and *:* for a UDP listener. For ...
- 179
6
votes
Do 0.0.0.0:0 and *:* represent the same thing?
In both cases the information is basically meaningless, but indicates more-or-less the same thing.
Your first line is a TCP listen socket. The local address column indicates the address and port that ...
- 1,202
6
votes
Powershell one-liner to show process on same line as port using netstat issue
JosefZ's answer perfectly explains your issue. You are using regex and it is doing exactly what you are asking it to do just perhaps replacing more than you expected.
A side note is that you are ...
- 1,186
5
votes
How do I kill a process that is dead but listening?
I've tried all solutions commented above and not one worked for me. I've kept researching and I got this answer, which is a combination using @Michael comment and this link https://serverfault.com/...
- 151
5
votes
What does "msnbot" mean in netstat listings?
It is the Network Connection Broker service (NcbService) that keeps calling out. Its function is to 'allow Windows Store Apps to receive notifications from the internet'.
Hit 'Win+R' > enter '...
- 61
5
votes
Accepted
Reset Netstat statistics
The netstat tool gathers statistics from various sources provided by the kernel:
/proc/net/snmp
/proc/net/netstat
/proc/net/sctp/snmp # if used
and possibly others. As these kernel data are not reset ...
- 4,703
4
votes
How do I kill a process that is dead but listening?
saw similar issue when root cause was some child process created inheriting the ports, parent process crashed, while child process still holding the port. Resolution was to identify the child process ...
- 141
4
votes
What is the difference between :::: and 0.0.0.0 from the netstat -an output?
:: and 0.0.0.0 have the same meaning but in completely different context. They are not the same.
At the server side both are used to denote "no particular address" if you binding processes (not ...
- 151
4
votes
How to use netstat to show what process is listening on a port
For me, the following two lines work best to show which apps have listening ports open, and tunnel, lsof is fully cross-platform:
netstat -Watn | grep LISTEN
lsof -Pnl +M -i -cmd | grep LISTEN
- 234
4
votes
netstat with process name?
Here is an example for windows using FOR to parse netstat output then DO tasklist with /fi filter on pid to show process name.
The last find is to remove tasklist headers.
FOR /F "usebackq tokens=...
- 139
4
votes
Accepted
Disable default VPN ports on windows 500 and 4500
You need to stop the “IKE and AuthIP IPsec Keying Modules” (short name: “IKEEXT”) service. It’ll obviously break Windows’ IPSec VPN client until you start them again.
- 56.9k
3
votes
netstat with process name?
If you're fond of using PS, you can fork this code (note: it's super-basic)
$nets = netstat -ano | select-string LISTENING
foreach($n in $nets){
# make split easier PLUS make it a string instead ...
- 31
3
votes
Why does explorer.exe has an established connection to a microsoft server?
Windows connects to MS servers for many purposes, like syncing time, checking for updates, and even tiny things like displaying whether your PC has access to the internet when you mouse over the ...
- 34.1k
3
votes
Accepted
How to use Continuously (-c) with grep on netstat?
It appears that you need to forget netstat -c and use watch instead:
watch 'netstat -tap|grep http'
You may want to add options to watch, including -n to set the repetition rate, and -d to highlight ...
- 17k
3
votes
Accepted
What exactly does this netstat output mean?
When you run netstat -b:
Displays the executable involved in creating each connection or
listening port. In some cases well-known executables host multiple
independent components, and in these ...
- 1,490
Only top scored, non community-wiki answers of a minimum length are eligible