netstat equivelant command

Question

Level 2

430 points

netstat equivelant command

Hi
I allow specific xhosts to fire hpterms at my X11 using xhost + hostname, then telnet to the HP-UX machine. Then export my DISPLAY to my Apple:0.0. Works fine for years, but the network changed overnight and the hpterms are no longer received on my Apple. On the hp-ux machines I see this after firing the hpterms to my machine:-

root tbsm01 => netstat -an|grep 6000
tcp 0 0 10.1.99.10.2637 10.1.99.21.6000 SYN_SENT
tcp 0 0 10.1.99.10.2636 10.1.99.21.6000 SYN_SENT
tcp 0 0 10.1.99.10.2635 10.1.99.21.6000 SYN_SENT
tcp 0 0 10.1.99.10.2634 10.1.99.21.6000 SYN_SENT
tcp 0 0 10.1.99.10.2633 10.1.99.21.6000 SYN_SENT
tcp 0 0 10.1.99.10.2632 10.1.99.21.6000 SYN_SENT

OK, netstat on my Apple shows nothing on port 6000, but port 6000 is allowed in my firewall! Does anyone know what the Apple command is for netstat -an???

I need to see if I am listening on that socket, and indeed if I see anything trying to attach to it. Thanks!

Posted on Sep 29, 2005 3:11 AM

Reply

Answer 1

Sep 29, 2005 3:23 AM in response to jed

Does this document help?

http://developer.apple.com/documentation/Darwin/Reference/ManPages/man1/netstat. 1.html

you can use netstat -an syntax on Apple Terminal-- though, it results in the same behaviour with Network Utility.

Here is odd events on DirectoryService.server.log about two hours ago.

2005-09-29 16:12:49 JST - DirectoryService 2.0.2 (v350.2) starting up...
2005-09-29 16:12:50 JST - Plugin <Configure>, Version <1.7>, processed successfully.
2005-09-29 16:12:50 JST - Plugin <NetInfo>, Version <1.7.2>, processed successfully.
2005-09-29 16:12:50 JST - Plugin <LDAPv3>, Version <1.7.2>, processed successfully.
2005-09-29 16:12:50 JST - Plugin <Search>, Version <1.7>, processed successfully.
2005-09-29 16:12:50 JST - Plugin "Active Directory", Version "1.5.2", is set to load lazily.
2005-09-29 16:12:50 JST - Plugin "AppleTalk", Version "1.2", is set to load lazily.
2005-09-29 16:12:50 JST - Plugin "Bonjour", Version "1.2", loaded successfully.
2005-09-29 16:12:50 JST - Plugin "BSD", Version "1.2", is set to load lazily.
2005-09-29 16:12:50 JST - Plugin "PasswordServer", Version "2.1", is set to load lazily.
2005-09-29 16:12:50 JST - Plugin "SLP", Version "1.2.1", is set to load lazily.
2005-09-29 16:12:50 JST - Plugin "SMB", Version "1.2", is set to load lazily.
2005-09-29 16:12:50 JST - Registered node /Configure
2005-09-29 16:12:50 JST - Plug-in Configure state is now active.
2005-09-29 16:12:50 JST - Plug-in LDAPv3 state is now active.
2005-09-29 16:12:50 JST - Plug-in Bonjour state is now active.
2005-09-29 16:12:50 JST - Registered node /Search
2005-09-29 16:12:50 JST - Registered node /Search/Contacts
2005-09-29 16:12:50 JST - Registered node /Search/Network
2005-09-29 16:12:50 JST - Plug-in Search state is now active.
2005-09-29 16:12:50 JST - Registered node /NetInfo/DefaultLocalNode
2005-09-29 16:12:50 JST - Plug-in NetInfo state is now active.
2005-09-29 16:12:51 JST - Network transition occurred.
2005-09-29 16:12:54 JST - Registered Locally Hosted Node /NetInfo/DefaultLocalNode
2005-09-29 16:12:55 JST - Network transition occurred.
2005-09-29 16:12:55 JST - Network transition occurred.
2005-09-29 16:12:55 JST - Network transition occurred.
2005-09-29 16:16:03 JST - Network transition occurred.
2005-09-29 16:16:03 JST - Network transition occurred.
2005-09-29 16:16:03 JST - Network transition occurred.
2005-09-29 16:27:17 JST - Network transition occurred.
2005-09-29 16:27:17 JST - Network transition occurred.
2005-09-29 16:27:23 JST - Network transition occurred.
2005-09-29 16:27:23 JST - Network transition occurred.
2005-09-29 16:27:23 JST - Network transition occurred.
2005-09-29 16:48:38 JST - Plug-in SLP state is now active.
2005-09-29 16:48:38 JST - Plugin "SLP", Version "1.2.1", loaded on demand successfully.
2005-09-29 16:48:39 JST - Plug-in SMB state is now active.
2005-09-29 16:48:39 JST - Plugin "SMB", Version "1.2", loaded on demand successfully.
2005-09-29 16:48:39 JST - Plug-in AppleTalk state is now active.
2005-09-29 16:48:39 JST - Plugin "AppleTalk", Version "1.2", loaded on demand successfully.

Although I've never activated SMB, AppleTalk, and SLP. In the meantime, another odd phenomenon occurred with Keychain Access. I noticed there is another login generic icon displayed, and the invisible file is located on the desktop. I deleted it from Keychain List. I also could not login Apple Discussions until I restarted the computer.

Reply

Answer 2

Morgoth

Level 2

352 points

Sep 29, 2005 4:08 AM in response to jed

Based on my experience, SYN_SENT connection are most of the time caused by Firewall configuration problem.

but the network changed overnight

Do you have more informations about what was changed ? This information could help to locate the problem.

Reply

Answer 3

Sep 29, 2005 5:02 AM in response to Fumiaki Kawashima

jed, if you see only the SYN_SENT flags (1/3 ways handshake connection protocol), you need to check the rest of flags for a TCP connection. Because, you show us that the socket is trying to establish a connection to a remote peer. But, nothing to show us about events for the connection establishment.

Are there any automated programs for outgoing you install?

I need to see if I am listening on that socket

This depends on your Firewall/s configurations.

Reply

Answer 4

jed Author

Level 2

430 points

Oct 2, 2005 9:22 AM in response to jed

Hi All
Apparently the network didn't change (It was the UMTS one that changed, anyway) I am on the same physical segemnt as the HP-UX box, I actaully see the following in my system.log "stealth Mode Connection attempt to UDP 10.1.99.21:6000 from 10.1.99.10" I have stealth mode active in my firewall (just the inbuild Apple firewall) and have had for quite some time, this has never stopped inbound Hpterm windows. netstat hows nothing on my machine for port 6000, Thanks for helping, but it is still rejecting, or not answering to the port requests, regards Jed

Reply