Netstat command output explanation.

nobitavn · 10-12-2010, 10:49 PM

Hi all,

When i typed netstat -lna, the output:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:580 0.0.0.0:* LISTEN
...
...

Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node
unix 2 [ ACC ] STREAM LISTENING 23581
...
...

Can anyone explain to me:
1. What is "Active Internet connections" & "Active UNIX domain sockets"?
2. What is unix Proto?
3. Difference between LISTEN and LISTENING state.

I searched in google but i not found much information.

Thanks in advance.

tommcd · 10-12-2010, 11:02 PM

Here is a good tutorial I found a while back on using netstat:
http://linuxplanet.com/linuxplanet/tutorials/5633/1/
I think Proto is simply short for protocol.

nobitavn · 10-12-2010, 11:20 PM

Hi tommcd,

Thank you,I have read the website.
But I haven't found the answer yet.
Can you explain to me what is unix protocol? and what is Active UNIX domain sockets?

Thanks again.

Tinkster · 10-12-2010, 11:32 PM

Here ...

Let me google this for you ...

Link #2 looks VERY promising

tommcd · 10-12-2010, 11:33 PM

Quote:

Originally Posted by nobitavn

Can you explain to me what is unix protocol? and what is Active UNIX domain sockets?

Well, for "Active Unix Domain sockets", according to that tutorial on linux planet:

Quote:

You can ignore everything under "Active UNIX domain sockets." Those are local inter-process communications, not network connections. To avoid displaying them at all, do this:
$ netstat --inet -a
This will display only network connections, both listening and established.

Since the unix protocol falls under the Active UNIX domain sockets, you can likely ignore all of that also.

nobitavn · 10-13-2010, 01:10 AM

Hi tommcd,

I got it, thank you so much.

Regards,

tommcd · 10-13-2010, 01:22 AM

Glad I could be of help!
I am most definitely not any kind of a networking guru. But from a security standpoint, I have wondered about this also. Form my rather limited understanding, I have found that simply running:

Code:

netstat --inet -a

will yield the most useful info.
NOTE: If you have any bittorrent apps running, you will get a crapload of connections when you run netstat because it will list all of the users that are uploading or downloading your torrent files.

nobitavn · 10-13-2010, 05:06 AM

Hi tommcd,

Thanks a lot.
When i run netstat --inet -anp. The result display:

Quote:

Local Address Foreign Address State
0.0.0.0:5801 0.0.0.0:* LISTEN
127.0.0.1:25 0.0.0.0:* LISTEN
192.168.81.23:1522 192.168.81.47:1646 ESTABLISHED
127.0.0.1:32791 127.0.0.1:1522 ESTABLISHED

What's mean of IP and port display?
From remote PC, i can connect to port 5802 and 1521 in this example.
But i can't connect to port 25 (Connection refused)

Thank you.
Regards,

Tinkster · 10-13-2010, 11:21 AM

Quote:

Originally Posted by nobitavn

Hi tommcd,

Thanks a lot.
When i run netstat --inet -anp. The result display:

What's mean of IP and port display?
From remote PC, i can connect to port 5802 and 1521 in this example.
But i can't connect to port 25 (Connection refused)

Thank you.
Regards,

That's because it's only listening on the loop-back
interface, not the one bound to your ethernet/wifi card.

Have a look: http://lmgtfy.com/?q=127.0.0.1