Active connections conundrum involving lsof / netstat output

uncle-c · 12-08-2007, 07:24 PM

Hi, just something which I find a bit confusing and I wonder if anyone could kindly clarify things.
Currently I am using the web ( logged into LQ) and listening to music using xmms which has opened a M3U playlist file and is streaming the music from a remote server. Now when I run netstat -ta to show my active connections only the connection to the music server appears and my connection to LQ ( or any other web site) is not shown. The same happens when I run the lsof -i:80 command.

Code:

[uncle@localhost Desktop]# netstat -ta
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State
tcp        0      0 *:netbios-ssn               *:*                         LISTEN
tcp        0      0 *:sunrpc                    *:*                         LISTEN
tcp        0      0 *:ipp                       *:*                         LISTEN
tcp        0      0 *:microsoft-ds              *:*                         LISTEN
tcp    90192      0 192.168.0.11:2213           apache2-twiddle.yoohoo:http ESTABLISHED
tcp        0      0 *:ssh                       *:*                         LISTEN
tcp        0      0 *:ipp                       *:*                         LISTEN

Code:

[uncle@localhost Desktop]# lsof -i:80
COMMAND   PID USER   FD   TYPE  DEVICE SIZE NODE NAME
xmms    14404  uncle   14u  IPv4 1640859       TCP 192.168.0.11:4977->apache2-twiddle.yoohoo.dreamhost.com:http (ESTABLISHED)

apache2-twiddle.yoohoo.dreamhost.com is the music server.

I assumed that netstat -ta would show all my active TCP connections so why is the connection to the LQ web server not shown when using either the netstat or lsof commands ?

Thanks again !

Uncle

Ps: I have run both commands as root and get the same output.

Agrouf · 12-08-2007, 07:29 PM

I believe this is because the connection to LQ is made just to download the web page and then closed. Once the page is displayed, the connection has already been closed, as opposed to streaming music, which leaves the connection open while there are still things to download, until the music is stopped.

uncle-c · 12-08-2007, 07:42 PM

Thanks for the reply Agrouf, but surely if I am logged in and typing as I am now, the connection to LQ will remain open and thus should show up in netstat / lsof ?

uncle

Agrouf · 12-08-2007, 07:46 PM

No, I don't think so.
When you are typing, you are typing on firefox (or whatever browser). The connection to LQ is done only when you hit 'send reply'.
To test it, just type something and close your browser. Open again and see that your message is lost. LQ is not aware of what you typed until you send it with 'send reply'

David1357 · 12-08-2007, 10:55 PM

Quote:

Originally Posted by uncle-c

Thanks for the reply Agrouf, but surely if I am logged in and typing as I am now, the connection to LQ will remain open and thus should show up in netstat / lsof ?

No. You are typing into a local application (a form in a web browser). You do not make a connection back to the webserver until you "submit" the form.

uncle-c · 12-09-2007, 07:46 AM

Thanks very much Agrouf / David. Apologies in advance for asking trivial questions but the answers always help one grasp a better understanding of the underlying methods and concepts.

Thanks again !

Uncle.

anomie · 12-09-2007, 11:19 AM

To further demonstrate the point already made by the others, you could observe the active connection to LQ (if you can catch it) by making your browser nice and small and then putting a terminal next to it running the command:
$ watch -n 1 netstat -ta

Reload the page and see the active connection appear and disappear...

uncle-c · 12-09-2007, 11:39 AM

Thanks anomie.I tried the above. I was on a specific website and did no input of any kind but was given a constant "Established" output in my netstat command. Could that be the web server sending me a constant stream of data / info of some description ? Sometimes when I quit a page totally I am left with netstat outputs such as Listen /wait ( from the site I am connected to). Is this the client waiting for some repsonse from the server so it can terminate or continue the connection ?

Thanks again,
Uncle

anomie · 12-09-2007, 11:56 AM

Quote:

Originally Posted by uncle-c

Sometimes when I quit a page totally I am left with netstat outputs such as Listen /wait ( from the site I am connected to). Is this the client waiting for some repsonse from the server so it can terminate or continue the connection ?

You may be interested in looking at the netstat(8) manpages, under the 'State' section. This lists brief but (mostly) helpful descriptions of some of the various connection states.

---

As for why you see different behaviors with different websites, hard to say.

For pages that reload themselves frequently and/or load advert material (such as yahoo), I'd imagine you may see an established connection even if you're not posting requests yourself.