Know thy open sockets: My favorite netstat option
Posted : June 22, 2004 at 5:59 pm [America/Los_Angeles]
[root@wwwin-as asdeploy]# netstat -pln Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:32768 0.0.0.0:* LISTEN 557/rpc.statd tcp 0 0 0.0.0.0:993 0.0.0.0:* LISTEN 702/xinetd tcp 0 0 0.0.0.0:8007 0.0.0.0:* LISTEN 23952/java tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 822/mysqld tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN 702/xinetd tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 702/xinetd tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 529/portmap tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 23996/httpd tcp 0 0 0.0.0.0:6000 0.0.0.0:* LISTEN 14268/X tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 702/xinetd tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 669/sshd tcp 0 0 0.0.0.0:23 0.0.0.0:* LISTEN 702/xinetd tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 730/sendmail: accep udp 0 0 0.0.0.0:32768 0.0.0.0:* 557/rpc.statd udp 0 0 0.0.0.0:733 0.0.0.0:* 557/rpc.statd udp 0 0 0.0.0.0:111 0.0.0.0:* 529/portmap Active UNIX domain sockets (only servers) Proto RefCnt Flags Type State I-Node PID/Program name Path unix 2 [ ACC ] STREAM LISTENING 1138 822/mysqld /tmp/mysql.sock unix 2 [ ACC ] STREAM LISTENING 606571 14268/X /tmp/.X11-unix/X0 unix 2 [ ACC ] STREAM LISTENING 1153 850/xfs /tmp/.font-unix/fs7100 unix 2 [ ACC ] STREAM LISTENING 1070 749/gpm /dev/gpmctl
This tells you all open sockets (TCP, UDP and Unix sockets) that your server is listening to, along with the process ID and the program name that is responsible for actually opening the socket. Extremely useful in getting an honest picture (provided your netstat executable has not yet been compromised) of the surface area that you’ve exposed for a script kiddie or a hacker to piggyback on and come waltzing in on.
Note:
1. Try netstat -pant if you want to look at ESTABLISHED connections as well. In other words, if you want to see who (if anyone) is currently connected to one of the many sockets on your server.
2. The server used for this sample execution is not a good example of what ought to be running on your system 
3. If the alignment of this page is slightly messed up, you’re using IE and I really am tired of IE’s inconsistent CSS standards support. Try switching to Firefox. PLLEAAASSSEE 
- Anand
Category: Services and Software