Understanding netstat output

[David Teh]

Hi folks,

I’ve an outbound thread to a system on port 15022.

When the receiving system stopped sending ACK, I did a restart, checked netstat and this is what I got:

sgclvuat.52818       10.168.28.168.15022      1      0 33580      0 ESTABLISHED

sgclvuat.42498       10.168.28.168.15022      1      0 33580      0 ESTABLISHED

sgclvuat.40461       10.168.28.168.15022  64512      0 33580      0 ESTABLISHED

I half-expected to see FIN WAIT but 3 “ESTABLISHED”s?

What may be the problem?

TIA!

Topic

[David Teh]

Adding to the mystery, after stopping the thread, I got this output:

sgclvuat.52818       10.168.28.168.15022      1      0 33580      0 ESTABLISHED

sgclvuat.43919       10.168.28.168.15022  65024      0 33580      0 FIN_WAIT_2

sgclvuat.42498       10.168.28.168.15022      1      0 33580      0 ESTABLISHED

How do we explain the 2 ‘ESTABLISHED’s? I’ve no other threads configured to that same port.

TIA!

[Robert Milfajt]

The other system could have a multiserver capability allowing multiple connections to a single port.  You should have them recycle their side when this happens.

Hope this helps,

Robert Milfajt
Northwestern Medicine
Chicago, IL

[David Barr]

You should try running netstat with the -o or -p flag (whichever one it is that shows the process ID on your OS). It would be interesting to see if the extra connections are from a single process or if you have some duplicate hciengine processes hanging around. You can also use the ps or lsof commands to help figure out which process is tied to each connection.

[Author]

Replies