Questions tagged [netstat]
Netstat is a command line tool that shows network related information like listening sockets, routing rules, open connections and also various statistics.
21
questions
0
votes
1
answer
55
views
Looking at internal ports through netstat command [closed]
I have a connection to another machine and was looking at which ports are open internally and which ports are open on all interfaces, I ran the following netstat command to achieve this
netstat -ano
...
- 41
1
vote
1
answer
186
views
Why doesn't iptables command take effect on my embeded Linux?
I'm running an embedded Linux system, whose kernel is 3.18.21, with some applications on top it on MIPS. When I run iptables & ip6tables on the Linux, such as the following:
iptables -A INPUT -p ...
- 123
1
vote
1
answer
965
views
How to locate a malicious script in the Linux system
I would like to ask for some directions to trace back to the original (malicious) script on my system (Ubuntu Server). I would try to be more specific if needed. If the question does not fit this ...
- 131
0
votes
1
answer
579
views
Why http microsoft connection in netstat check?
I checked established connections with "netstat" command in command prompt, and I found that there are some connections with ip's of microsoft (I checked ip online) that have http (and not ...
- 3
-1
votes
1
answer
642
views
Netstat switches [closed]
I was monitoring network connections using Netstat and came across netstat -tlnp. I was wondering what this is, what it does, and how the command works. I have checked the netstat man pages for my ...
- 51
-1
votes
2
answers
3k
views
Tor relay on port 9001 TCP
I executed netstat -t on my linux terminal and noticied a tor relay running on port 9001. I've search about the IP address of relay on shodan and got a result that address is from Russia, after that i ...
- 3
0
votes
1
answer
101
views
Connection changes after waking from sleep
On Debian, Linux, I am using netstat to monitor connections. After waking my system from sleep, I noticed a change in one of the connections, using port 6667 for irssi (identified by PID).
I like to ...
- 3
0
votes
1
answer
999
views
Understanding, Interpreting and Taking Action on Established Connections [closed]
Background:
I have what I believe is a serious malware problem but virtually all scanning tools won't detect anything or if they do rarely do so consistently. I believe the malware (in some way/...
- 19
3
votes
2
answers
566
views
odd ip address connected to my box
Today i went to the library. I was looking at my netstat -an output and i saw this.
tcp 0 0 127.0.0.1:6379 127.0.0.1:46376 ESTABLISHED
tcp 0 0 127.0.0.1:46376 ...
- 141
4
votes
2
answers
1k
views
Shouldn't netstat show connections from many different IP addresses during a DDoS, unlike this example?
I just read this article from loggly (https://www.loggly.com/blog/how-to-detect-and-analyze-ddos-attacks-using-log-analysis/), and it got me wondering.
The author states that under a DDoS attack, ...
- 151
2
votes
1
answer
1k
views
Suspicious SSH connection
this is the situation:
vps with debian 8x32 virgin (new template of the provider's repository);
exotic "user" and strong "password" ;
30 seconds later: command (apt-get update);
30 seconds later: ...
- 23
23
votes
5
answers
14k
views
Find IM user location via netstat?
I got sent an article today (http://hakerin.com/facebook-user-location-finder-noobs/). With the click-bait title "Facebook User location Finder" Of course I clicked it.
Going through the "article" ...
- 355
1
vote
1
answer
2k
views
Is it suspicious that netstat shows many established connections related with 5KPlayer?
I am working on an ASP.NET application and, as usually, tried to deploy it on IIS Express from Visual Studio. This time, IIS error occured. The error was caused by the application port being occupied ...
- 165
1
vote
1
answer
1k
views
Weird Procceses [closed]
Can someone tell me if netstat -a -n -o is throwing something out of normal?
I Have nothing running except for the Windows Explorer in 4584
TCP 0.0.0.0:135 0.0.0.0:0 ...
- 11
0
votes
1
answer
2k
views
How to track if someone is remotely watching your network [closed]
How can i check that I am being remotely watched? This is the netstat results of my current network. Is someone able to check if someone is remotely stalking me?
Are there any suggestions on how I ...
- 3
5
votes
1
answer
2k
views
I ran netstat and one thing that came up was MSN bingbot, does that mean my computer is being used as part of a Microsoft botnet?
I ran netstat on my computer, and one thing that came up was msnbot-65-52-108-216. I did some research and what came up was that it's from an IP originating in Redmond, Washington and that it's likely ...
- 333
0
votes
1
answer
827
views
Command prompt netsat malware detection [closed]
I suspect I have malware in my laptop. Can someone explain what is happening in that log? I'm using public WiFi.
- 1
1
vote
1
answer
3k
views
Why is my Windows 10 machine listening for 127.127.127.127:3939?
I was hoping someone out there could answer why my Windows 10 Machine would be listening on port 3939 using 127.127.127.127 over TCP?
I get the below with netstat -nat:
TCP 127.127.127.127:3939 ...
- 13
2
votes
1
answer
452
views
SYN Flood from fixed spoof IP but receive only one packet
I'm generating a network flood with a lot of packets coming from one fixed IP+port pair (in this example, 1.2.3.4:2003). Why do I only see one SYN_RECV'd packet in netstat on the victim machine?
- 121
2
votes
2
answers
2k
views
UDP sockets open on all ports
I'm on osx. netstat -an -f inet gives me a bunch (around 10) of entries like these:
...
udp4 0 0 *.* *.*
udp46 0 0 *.* *.*
...
In my ...
- 123
0
votes
1
answer
652
views
Organizing results from netstat using find on Windows [closed]
I am trying to figure out a way to natively do this within Windows without having to load any 3rd party applications. When I run:
netstat -ba
I want to find established connections without losing ...
- 849