LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
Search this Thread
Old 12-08-2007, 06:24 PM   #1
uncle-c
Member
 
Registered: Oct 2006
Location: The Ether
Distribution: Fedora 14, Ubuntu , Slax 5.1.8, OpenSolaris, Centos 4.8
Posts: 296

Rep: Reputation: 30
Active connections conundrum involving lsof / netstat output


Hi, just something which I find a bit confusing and I wonder if anyone could kindly clarify things.
Currently I am using the web ( logged into LQ) and listening to music using xmms which has opened a M3U playlist file and is streaming the music from a remote server. Now when I run netstat -ta to show my active connections only the connection to the music server appears and my connection to LQ ( or any other web site) is not shown. The same happens when I run the lsof -i:80 command.

Code:
[uncle@localhost Desktop]# netstat -ta
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State
tcp        0      0 *:netbios-ssn               *:*                         LISTEN
tcp        0      0 *:sunrpc                    *:*                         LISTEN
tcp        0      0 *:ipp                       *:*                         LISTEN
tcp        0      0 *:microsoft-ds              *:*                         LISTEN
tcp    90192      0 192.168.0.11:2213           apache2-twiddle.yoohoo:http ESTABLISHED
tcp        0      0 *:ssh                       *:*                         LISTEN
tcp        0      0 *:ipp                       *:*                         LISTEN
Code:
[uncle@localhost Desktop]# lsof -i:80
COMMAND   PID USER   FD   TYPE  DEVICE SIZE NODE NAME
xmms    14404  uncle   14u  IPv4 1640859       TCP 192.168.0.11:4977->apache2-twiddle.yoohoo.dreamhost.com:http (ESTABLISHED)
apache2-twiddle.yoohoo.dreamhost.com is the music server.

I assumed that netstat -ta would show all my active TCP connections so why is the connection to the LQ web server not shown when using either the netstat or lsof commands ?

Thanks again !

Uncle

Ps: I have run both commands as root and get the same output.

Last edited by uncle-c; 12-08-2007 at 06:27 PM. Reason: additional material added.
 
Old 12-08-2007, 06:29 PM   #2
Agrouf
Senior Member
 
Registered: Sep 2005
Location: France
Distribution: LFS
Posts: 1,591

Rep: Reputation: 79
I believe this is because the connection to LQ is made just to download the web page and then closed. Once the page is displayed, the connection has already been closed, as opposed to streaming music, which leaves the connection open while there are still things to download, until the music is stopped.

Last edited by Agrouf; 12-08-2007 at 06:31 PM.
 
Old 12-08-2007, 06:42 PM   #3
uncle-c
Member
 
Registered: Oct 2006
Location: The Ether
Distribution: Fedora 14, Ubuntu , Slax 5.1.8, OpenSolaris, Centos 4.8
Posts: 296

Original Poster
Rep: Reputation: 30
Thanks for the reply Agrouf, but surely if I am logged in and typing as I am now, the connection to LQ will remain open and thus should show up in netstat / lsof ?

uncle
 
Old 12-08-2007, 06:46 PM   #4
Agrouf
Senior Member
 
Registered: Sep 2005
Location: France
Distribution: LFS
Posts: 1,591

Rep: Reputation: 79
No, I don't think so.
When you are typing, you are typing on firefox (or whatever browser). The connection to LQ is done only when you hit 'send reply'.
To test it, just type something and close your browser. Open again and see that your message is lost. LQ is not aware of what you typed until you send it with 'send reply'
 
Old 12-08-2007, 09:55 PM   #5
David1357
Senior Member
 
Registered: Aug 2007
Location: South Carolina, U.S.A.
Distribution: Ubuntu, Fedora Core, Red Hat, SUSE, Gentoo, DSL, coLinux, uClinux
Posts: 1,300
Blog Entries: 1

Rep: Reputation: 107Reputation: 107
Quote:
Originally Posted by uncle-c View Post
Thanks for the reply Agrouf, but surely if I am logged in and typing as I am now, the connection to LQ will remain open and thus should show up in netstat / lsof ?
No. You are typing into a local application (a form in a web browser). You do not make a connection back to the webserver until you "submit" the form.
 
Old 12-09-2007, 06:46 AM   #6
uncle-c
Member
 
Registered: Oct 2006
Location: The Ether
Distribution: Fedora 14, Ubuntu , Slax 5.1.8, OpenSolaris, Centos 4.8
Posts: 296

Original Poster
Rep: Reputation: 30
Thanks very much Agrouf / David. Apologies in advance for asking trivial questions but the answers always help one grasp a better understanding of the underlying methods and concepts.

Thanks again !

Uncle.
 
Old 12-09-2007, 10:19 AM   #7
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora, Lubuntu, FreeBSD
Posts: 3,930
Blog Entries: 5

Rep: Reputation: Disabled
To further demonstrate the point already made by the others, you could observe the active connection to LQ (if you can catch it) by making your browser nice and small and then putting a terminal next to it running the command:
$ watch -n 1 netstat -ta

Reload the page and see the active connection appear and disappear...
 
Old 12-09-2007, 10:39 AM   #8
uncle-c
Member
 
Registered: Oct 2006
Location: The Ether
Distribution: Fedora 14, Ubuntu , Slax 5.1.8, OpenSolaris, Centos 4.8
Posts: 296

Original Poster
Rep: Reputation: 30
Thanks anomie.I tried the above. I was on a specific website and did no input of any kind but was given a constant "Established" output in my netstat command. Could that be the web server sending me a constant stream of data / info of some description ? Sometimes when I quit a page totally I am left with netstat outputs such as Listen /wait ( from the site I am connected to). Is this the client waiting for some repsonse from the server so it can terminate or continue the connection ?

Thanks again,
Uncle

Last edited by uncle-c; 12-09-2007 at 10:45 AM.
 
Old 12-09-2007, 10:56 AM   #9
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora, Lubuntu, FreeBSD
Posts: 3,930
Blog Entries: 5

Rep: Reputation: Disabled
Quote:
Originally Posted by uncle-c
Sometimes when I quit a page totally I am left with netstat outputs such as Listen /wait ( from the site I am connected to). Is this the client waiting for some repsonse from the server so it can terminate or continue the connection ?
You may be interested in looking at the netstat(8) manpages, under the 'State' section. This lists brief but (mostly) helpful descriptions of some of the various connection states.

---

As for why you see different behaviors with different websites, hard to say. For pages that reload themselves frequently and/or load advert material (such as yahoo), I'd imagine you may see an established connection even if you're not posting requests yourself.
 
  


Reply

Tags
connections, lsof, netstat


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
using netstat /lsof to good effects Swakoo Linux - Security 6 05-27-2007 10:52 PM
netstat output rob.rice Linux - Networking 2 04-29-2007 09:18 AM
What does this netstat output mean? Kovacs Linux - Security 2 01-25-2004 06:32 PM
netstat -l output help dai Linux - Security 2 07-02-2003 03:40 PM
netstat output... WeNdeL Linux - Networking 3 03-20-2003 09:45 AM


All times are GMT -5. The time now is 10:56 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration