search for: sockstat

Heya.. By reading my /usr/local/etc/apache2/httpd.conf, I can find out that my Apache is running as the user "www" and the group "www" .. Yet, when I run sockstat, it tells me one of the forks are runned as root and listening on port 80 as well as the other forks are runned by www:www.. If I got a lot of users connecting to my server on port 80, will thier requests ever be answered by the root fork or the www:www forks? --- snip --- [root@ninja:~]# sockstat...

...ened as my printer all of sudden started to print stuff when nobody prints... luckily (or unluckily) it ran out of ink so I can't tell what's printed. Checked programs running, ports opened and found one unidentified: udp4 0 0 *.49152 *.* dimon@gateway ~ > sockstat | grep 49152 bind named 270 4 udp4 *:49152 *:* Now', is there any reason for bind to use this port? Googling for that subject didn't bring any results other than usualy this port is first available for dynamic ports. Which doesn't make sence to me. System:...

Hello. We have a webserver using FreeBSD, we read about tunning kern.ipc.somaxconn (http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/configtuning-kernel-limits.html) so the OS can handle all the connections. Is there a way to know how many connections are established in a certain moment?. I know about netstat(1) but is there any other command that we can use to know the exact amount of

Is there an equivalent command or application to "sockstat" as in the BSD camp under CentOS? How about systat ? Thanks... -- Snowman

...service imap-login { inet_listener imap { address = 127.0.0.1, ::1 port = 143 } inet_listener imaps { port = 9999 } process_min_avail = 3 service_count = 0 vsz_limit = 1 G } But I am not seeing any listeners on port 9999 - root at ns(1001)# netstat -an | grep 9999 Using sockstat on FreeBSD: root at ns(1002)# sockstat | grep dovecot | grep tcp root dovecot 34800 15 tcp4 *:4190 *:* root dovecot 34800 37 tcp4 127.0.0.1:143 *:* root dovecot 34800 38 tcp6 ::1:143 *:* I have mail_debug = yes, but I don'...

I get this in my security postings. Jun [undisclosed time] [undiscl.] login: 2 LOGIN FAILURES ON ttyv2 Jun [undisclosed time] [undiscl.] login: 2 LOGIN FAILURES ON ttyv2, qmaild As it turns out, I'm not running qmail :) And if I did, it would definitely have a nologin shell. But that's beside the point- I have had a perception that ttyv was for local/console logins, and that just

...ave resolved most of these issues. In dealing with this I ran across https://wiki.samba.org/index.php/Time_Synchronisation which contains this instruction: Set up the ntpd.conf File on a DC . . . ntpsigndsocket /usr/local/samba/var/lib/ntp_signd/ Now, on the FreeBSD host I see this instead: # sockstat | grep ntp root ntpd 6229 3 dgram -> /var/run/logpriv root ntpd 6229 20 udp6 *:123 *:* root ntpd 6229 21 udp4 *:123 *:* root ntpd 6229 22 udp4 192.168.8.65:123 *:* root ntpd 6229 23 udp6 ::1:123...

For those of you running * on FreeBSD: I compiled everything and can start. Sockstat -l shows that Asterisk listens on the correct interfaces and ports. Sniffing, I see registrations coming in to SIP debug, but nothing seems so reach Asterisk except IAX registration from a peer. Can't dial anywhere, can't reach the Asterisk with asterisk -r. Anyone recognizing this problem...

Dear all! Last evening I've noticed that my 5.2 box had strange result about nmap search. One port is randomly open when I look from user account. From root everything looks as expected. The comp is most time out of internet. The last thing was adding "expect" package. I am not paniced, could be hiting... Or something in "expect" package... It is random port from 53000 to

Hi, I am newbie started learning ruby on rails i had an application which used to run pretty well latter i upgraded from webbrick to mongrel 1.1.5 then I am getting the foloowing errors and a default application runs on port 3000 by name iphone configuration utility i am unable to attach the screen shot as it is saying file to large. Error which i get in terminal is listed below => Booting

...s and adds them to my packet filter (pf). Everything seems to work up to a point. The IP address gets added to my AUTOBLOCK table. The second rule, right after the friends whitelist, blocks any IP in that table. If I try to ping or traceroute to it I can't get through. I ran netstat -a and sockstat -c and the IP address does not show up in the connections. Every test suggests that the system is doing exactly what I want it to do. The weird thing is that the attempts don't stop. That IP continues to try different numbers. There are two ways that I have found so far to actually stop the...

...nd utilizing mount.cifs to access samba shares began thrashing on TCP port 445, causing high CPU load on the server. These machines now cause thrashing after 15-20 minutes whenever a share is mounted using mount.cifs. When it's thrashing, I see thousands of opened ports from a single client: # sockstat -4 | grep 10.0.1.87 | wc 10013 70091 740962 And on the client, the port is constant changing: $ netstat -net | grep 10.0.0.8 tcp 0 0 10.0.1.87:53122 10.0.0.8:445 ESTABLISHED 0 1253359 $ netstat -net | grep 10.0.0.8 tcp 0 0 10.0.1.87:53700 10....

...SD: releng/10.1/etc/nsswitch.conf 224765 2011-08-10 20:52:02Z dougb $ # #group: compat #group_compat: nis hosts: files dns networks: files #passwd: compat #passwd_compat: nis shells: files services: compat services_compat: nis protocols: files rpc: files group: files winbind user: files winbind # sockstat -4 USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS root winbindd 52698 26 tcp4 10.1.200.98:37794 10.1.200.99:445 root winbindd 52698 28 tcp4 10.1.200.98:37794 10.1.200.99:445 root winbindd 52698 30 tcp4 10.1.200.98:59691 10.1.200.99:389...

...soft; }; query-source address * port 53; }; zone "." { type hint; file "named.root"; }; zone "0.0.127.IN-ADDR.ARPA" { type master; allow-query { any; }; file "master/localhost.rev"; }; . . . 4.netstat -an or sockstat -4 result: ns# netstat -an Active Internet connections (including servers) Proto Recv-Q Send-Q Local Address Foreign Address (state) tcp4 0 48 122.254.1x.x.22 122.254.93.23.58663 ESTABLISHED tcp4 0 0 122.254.1x.x.63442 130.94.149.166.5999 TIME_WAI...

so i just found that one of my hosts is GENERATING these probe pairs, maybe every minute or two (note the sequence numbers): seq my host victim(s) --- ---------------- --------------- 24) 192.168.0.2:1121 <--> 216.52.3.2:2703 25) 192.168.0.2:1122 <--> 216.52.3.4:2703 39) 192.168.0.2:1124 <-->

...at 50%. It never goes above that. Some info about that error: [root at hostname /var/log]# netstat -anA | grep -i fffff8018a4ba3c0 fffff8018a4ba3c0 stream 0 0 fffff8016bc27938 0 0 0 /var/run/samba4/winbindd/pipe [root at hostname /var/log]# sockstat -l | grep -i /var/run/samba4/winbindd/pipe root winbindd 1101 22 stream /var/run/samba4/winbindd/pipe root winbindd 1100 22 stream /var/run/samba4/winbindd/pipe root winbindd 1099 22 stream /var/run/samba4/winbindd/pipe root winbindd 962 22 stream /var/run/samba4/winbin...

Hello, what is the right way to disable XFree86 and wdm listening ports tcp 6000 and tcp 1024. I read in man XFree86 about the -nolisten tcp option and tried to set in /usr/X11R6/lib/X11/xdm :0 local /usr/X11R6/bin/X -nolisten tcp but it was not successful. What is the right way to close the ports without use of IPFW? Your help would be appreciated. Thank?s Wolfgang

I have a server that has been compromised. I'm running version 4.6.2 when I do >last this line comes up in the list. shutdown ~ Thu Aug 28 05:22 That was the time the server went down. There seemed to be some configuration changes. Some of the files seemed to revert back to default versions (httpd.conf, resolv.conf) Does anyone have a clue what type of

...les dns >> networks: files >> #passwd: compat >> #passwd_compat: nis >> shells: files >> services: compat >> services_compat: nis >> protocols: files >> rpc: files >> >> group: files winbind >> user: files winbind >> >> # sockstat -4 >> USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN >> ADDRESS >> root winbindd 52698 26 tcp4 10.1.200.98:37794 10.1.200.99:445 >> root winbindd 52698 28 tcp4 10.1.200.98:37794 10.1.200.99:445 >> root winbindd 52698 30 tcp4 10.1.200....

...y > packet filter (pf). Everything seems to work up to a point. The IP > address gets added to my AUTOBLOCK table. The second rule, right after > the friends whitelist, blocks any IP in that table. If I try to ping or > traceroute to it I can't get through. I ran netstat -a and sockstat -c > and the IP address does not show up in the connections. Every test > suggests that the system is doing exactly what I want it to do. But yet, new packets from that IP address reach asterisk. It seems almost entirely clear to me that you have a firewall problem, not an asterisk proble...