LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   Netstat command output explanation. (https://www.linuxquestions.org/questions/linux-newbie-8/netstat-command-output-explanation-837699/)

nobitavn 10-12-2010 10:49 PM
Netstat command output explanation.
 
Hi all,

When i typed netstat -lna, the output:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:580 0.0.0.0:* LISTEN
...
...


Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node
unix 2 [ ACC ] STREAM LISTENING 23581
...
...

Can anyone explain to me:
1. What is "Active Internet connections" & "Active UNIX domain sockets"?
2. What is unix Proto?
3. Difference between LISTEN and LISTENING state.

I searched in google but i not found much information.

Thanks in advance.

tommcd 10-12-2010 11:02 PM
Here is a good tutorial I found a while back on using netstat:
http://linuxplanet.com/linuxplanet/tutorials/5633/1/
I think Proto is simply short for protocol.

nobitavn 10-12-2010 11:20 PM
Hi tommcd,

Thank you,I have read the website.
But I haven't found the answer yet.
Can you explain to me what is unix protocol? and what is Active UNIX domain sockets?

Thanks again.

Tinkster 10-12-2010 11:32 PM
Here ...

Let me google this for you ...

Link #2 looks VERY promising

tommcd 10-12-2010 11:33 PM
Quote:
Originally Posted by nobitavn (Post 4125586)
Can you explain to me what is unix protocol? and what is Active UNIX domain sockets?
Well, for "Active Unix Domain sockets", according to that tutorial on linux planet:
Quote:
You can ignore everything under "Active UNIX domain sockets." Those are local inter-process communications, not network connections. To avoid displaying them at all, do this:
$ netstat --inet -a
This will display only network connections, both listening and established.
Since the unix protocol falls under the Active UNIX domain sockets, you can likely ignore all of that also.

nobitavn 10-13-2010 01:10 AM
Hi tommcd,

I got it, thank you so much.

Regards,

tommcd 10-13-2010 01:22 AM
Glad I could be of help!
I am most definitely not any kind of a networking guru. But from a security standpoint, I have wondered about this also. Form my rather limited understanding, I have found that simply running:
Code:
netstat --inet -a
will yield the most useful info.
NOTE: If you have any bittorrent apps running, you will get a crapload of connections when you run netstat because it will list all of the users that are uploading or downloading your torrent files.

nobitavn 10-13-2010 05:06 AM
Hi tommcd,

Thanks a lot.
When i run netstat --inet -anp. The result display:

Quote:
Local Address Foreign Address State
0.0.0.0:5801 0.0.0.0:* LISTEN
127.0.0.1:25 0.0.0.0:* LISTEN
192.168.81.23:1522 192.168.81.47:1646 ESTABLISHED
127.0.0.1:32791 127.0.0.1:1522 ESTABLISHED
What's mean of IP and port display?
From remote PC, i can connect to port 5802 and 1521 in this example.
But i can't connect to port 25 (Connection refused)

Thank you.
Regards,

Tinkster 10-13-2010 11:21 AM
Quote:
Originally Posted by nobitavn (Post 4125887)
Hi tommcd,

Thanks a lot.
When i run netstat --inet -anp. The result display:



What's mean of IP and port display?
From remote PC, i can connect to port 5802 and 1521 in this example.
But i can't connect to port 25 (Connection refused)

Thank you.
Regards,

That's because it's only listening on the loop-back
interface, not the one bound to your ethernet/wifi card.

Have a look: http://lmgtfy.com/?q=127.0.0.1


All times are GMT -5. The time now is 10:05 AM.