Q: high-port tcp connections from localhost to localhost in HP-UX 11.31 - HP UX

This is a discussion on Q: high-port tcp connections from localhost to localhost in HP-UX 11.31 - HP UX ; Hi, I just noticed that a machine that is not doing a lot (except being an NFSv4 server) shows many (i.e. >50) TCP connections from localhost to localhost using high port numbers (i.e. >40000). Those connections are in state TIME_WAIT. ...

+ Reply to Thread
Results 1 to 4 of 4

Thread: Q: high-port tcp connections from localhost to localhost in HP-UX 11.31

  1. Q: high-port tcp connections from localhost to localhost in HP-UX 11.31

    Hi,

    I just noticed that a machine that is not doing a lot (except being an NFSv4
    server) shows many (i.e. >50) TCP connections from localhost to localhost
    using high port numbers (i.e. >40000). Those connections are in state
    TIME_WAIT. What also makes me wonder ist this pattern:

    localhost.A localhost.B
    localhost.B localhost.A

    (A and B are port numbers)

    Does anybody know what those connections are for?

    (Actually I wanted to find out whether there's an equivalent of Linux'
    "netstat -t" (that only shows TCP connections) for HP-UX 11.31, but there
    seems to be none)

    Regards,
    Ulrich

  2. Re: Q: high-port tcp connections from localhost to localhost in HP-UX 11.31

    Ulrich Windl wrote:
    > I just noticed that a machine that is not doing a lot (except being
    > an NFSv4 server) shows many (i.e. >50) TCP connections from
    > localhost to localhost using high port numbers (i.e. >40000). Those
    > connections are in state TIME_WAIT. What also makes me wonder ist
    > this pattern:


    > localhost.A localhost.B
    > localhost.B localhost.A


    > (A and B are port numbers)


    > Does anybody know what those connections are for?


    Nope. If you can catch one in ESTABLISHED you might find something
    interesting from lsof. Similarly, a nettl on loopback. By the time
    the connection hits TIME_WAIT, chances are _very_ good there is no
    accompanying socket to find and so process. It is _possible_ but not
    very likely.

    > (Actually I wanted to find out whether there's an equivalent of
    > Linux' "netstat -t" (that only shows TCP connections) for HP-UX
    > 11.31, but there seems to be none)


    netstat -a | grep tcp

    rick jones
    --
    The computing industry isn't as much a game of "Follow The Leader" as
    it is one of "Ring Around the Rosy" or perhaps "Duck Duck Goose."
    - Rick Jones
    these opinions are mine, all mine; HP might not want them anyway...
    feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...

  3. Re: Q: high-port tcp connections from localhost to localhost in HP-UX 11.31

    Rick Jones writes:

    > Ulrich Windl wrote:
    >> I just noticed that a machine that is not doing a lot (except being
    >> an NFSv4 server) shows many (i.e. >50) TCP connections from
    >> localhost to localhost using high port numbers (i.e. >40000). Those
    >> connections are in state TIME_WAIT. What also makes me wonder ist
    >> this pattern:

    >
    >> localhost.A localhost.B
    >> localhost.B localhost.A

    >
    >> (A and B are port numbers)

    >
    >> Does anybody know what those connections are for?

    >
    > Nope. If you can catch one in ESTABLISHED you might find something
    > interesting from lsof. Similarly, a nettl on loopback. By the time
    > the connection hits TIME_WAIT, chances are _very_ good there is no
    > accompanying socket to find and so process. It is _possible_ but not
    > very likely.


    While looking for it, I also found a server listening on UDP localhost port
    49465 and port 49466. Unfortunately the machine lacks a "lsof". Using nettl, I
    goot a suspect that "WbemWrapperMonitor" creates those connections. I'm not
    good in reading the "netfmt" output.

    >
    >> (Actually I wanted to find out whether there's an equivalent of
    >> Linux' "netstat -t" (that only shows TCP connections) for HP-UX
    >> 11.31, but there seems to be none)

    >
    > netstat -a | grep tcp


    :-)

    >
    > rick jones
    > --
    > The computing industry isn't as much a game of "Follow The Leader" as
    > it is one of "Ring Around the Rosy" or perhaps "Duck Duck Goose."
    > - Rick Jones
    > these opinions are mine, all mine; HP might not want them anyway...
    > feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...


  4. Re: Q: high-port tcp connections from localhost to localhost in HP-UX 11.31

    Ulrich Windl wrote:

    > While looking for it, I also found a server listening on UDP
    > localhost port 49465 and port 49466. Unfortunately the machine lacks
    > a "lsof". Using nettl, I goot a suspect that "WbemWrapperMonitor"
    > creates those connections. I'm not good in reading the "netfmt"
    > output.


    IIRC ethereal used to be able to read nettl traces. Perhaps wireshark
    retains that ability?

    rick jones
    --
    Wisdom Teeth are impacted, people are affected by the effects of events.
    these opinions are mine, all mine; HP might not want them anyway...
    feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...

+ Reply to Thread