How to read netstat output

tcp   0     0   192.168.22.6:55017  www.oreillynet.com:www  ESTABLISHED

^    ^  ^     ^          ^           ^             ^           ^
|    |  |     |          |           |             |           |
|    |  |     |         port         remote      port      Connection
|    |  |   your machine             server                  State
|    |  bytes in send queue
|    Bytes in recive queue
| type of connection


Connection State can be
StateDescription

LISTEN accepting connections
ESTABLISHED connection up and passing data
SYN_SENT TCP; session has been requested by us; waiting for reply from remote endpoint
SYN_RECV TCP; session has been requested by a remote endpoint for a socket on which we were listening
LAST_ACK TCP; our socket is closed; remote endpoint has also shut down; we are waiting for a final acknowledgement
CLOSE_WAIT TCP; remote endpoint has shut down; the kernel is waiting for the application to close the socket
TIME_WAIT TCP; socket is waiting after closing for any packets left on the network
CLOSED socket is not being used (FIXME. What does mean?)
CLOSING TCP; our socket is shut down; remote endpoint is shut down; not all data has been sent
FIN_WAIT1 TCP; our socket has closed; we are in the process of tearing down the connection
FIN_WAIT2 TCP; the connection has been closed; our socket is waiting for the remote endpoint to shut down

Active UNIX domain sockets (servers and established)
Proto RefCnt Flags       Type       State         I-Node Path
unix  2      [ ACC ]     STREAM     LISTENING     21775    /tmp/.X11-unix/X0
unix  2      [ ACC ]     STREAM     LISTENING     22279    /var/run/sock.sock
|        |             |              |                  |                  |                 |
|        |             |              Stream        State          Inode        disk file
|        |             Flags
|        Reference Count
Protocol

A Unix domain socket (UDS) or IPC socket (inter-process communication socket) is a virtual socket, similar to an internet socket that is used in POSIX operating systems for inter-process communication. The correct standard POSIX term is POSIX Local IPC Sockets.

These connections appear as byte streams, much like network connections, but all data remains within the local computer.

In addition to sending data, processes can send file descriptors across a Unix domain socket connection using the sendmsg() and recvmsg() system calls.

Related Posts

Tags:

Leave a Reply

You must be logged in to post a comment.