LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 06-16-2009, 10:44 AM   #1
mokku
Member
 
Registered: Feb 2007
Posts: 197

Rep: Reputation: 30
netstat question


Hello All,

There are so many time_wait in our server and when I do netstat -a and it takes so long to response.

How do we who initiated the connection?

hostname.568 remotehostname 632 0 24820 0 TIME_WAIT

Thanks in advance.
 
Old 06-16-2009, 11:45 AM   #2
paulsm4
LQ Guru
 
Registered: Mar 2004
Distribution: SusE 8.2
Posts: 5,863
Blog Entries: 1

Rep: Reputation: Disabled
Hi -

Q: Did all/most of the other connections in time wait also use port 568?

Q: Did they come from the same remote host?

Q: Does "netstat" show you which process is *listening* on port 568?

1. You can use "lsof" to see which processes are using which TCP ports

2. You can use wireshark to take a trace of what's happening.

Here's one other link that might help:

http://www.cyberciti.biz/tips/netsta...-examples.html
 
Old 06-16-2009, 11:55 AM   #3
mokku
Member
 
Registered: Feb 2007
Posts: 197

Original Poster
Rep: Reputation: 30
Quote:
Originally Posted by paulsm4 View Post
Hi -

Q: Did all/most of the other connections in time wait also use port 568?

>It uses different port

Q: Did they come from the same remote host?

> Yes, same port from the remote host

Q: Does "netstat" show you which process is *listening* on port 568?

> No

1. You can use "lsof" to see which processes are using which TCP ports

2. You can use wireshark to take a trace of what's happening.

Here's one other link that might help:

http://www.cyberciti.biz/tips/netsta...-examples.html

Do we need to find the process to determine who initiated it?
 
Old 06-16-2009, 02:11 PM   #4
paulsm4
LQ Guru
 
Registered: Mar 2004
Distribution: SusE 8.2
Posts: 5,863
Blog Entries: 1

Rep: Reputation: Disabled
From what information you've given, it sounds like your server is listening on port 568 on your local host (the one you ran "netstat -a" on), and "remotehost" is the guy who connected to it.

If you've got a lot of "TIME_WAIT" ... and they're mostly the same port (e.g. "568") ... then it sounds like your service is being heavily used (a lot of - probably short term - connections).

And I would think you probably (if you don't already happen to know) want to figure out what it is, and what it's being used for.

Hence "lsof" and friends.

'Hope that helps .. PSM
 
Old 06-18-2009, 10:14 PM   #5
paulsm4
LQ Guru
 
Registered: Mar 2004
Distribution: SusE 8.2
Posts: 5,863
Blog Entries: 1

Rep: Reputation: Disabled
Q: So did you ever find out where all the TIME_WAIT's were coming from?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
netstat question - identifying process divukman Linux - Security 4 08-23-2006 10:35 AM
question netstat command nick623 Linux - Newbie 2 01-31-2005 08:53 PM
Question about netstat results JaseP Linux - Security 4 11-18-2004 01:09 PM
netstat question zepplin611 Linux - Networking 2 01-01-2004 03:54 PM
netstat question digsby0007 Linux - Networking 1 12-27-2003 06:33 PM


All times are GMT -5. The time now is 11:42 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration