Netstat analysis for outgoing/incoming connections

netstat supports a set of options to display active or passive sockets. The options –t, –u, –w, and –x show active TCP, UDP, RAW, or Unix socket connections. If you provide the –a flag in addition, sockets that are waiting for a connection (i.e., listening) are displayed as well. This display will give you a list of all servers that are currently running on your system.

Invoking netstat -ta on vlager produces this output:

$ netstat -ta (you can also use -n option to avoid the dns lookup for displaying domain names, which will save performace).

Active Internet Connections
Proto Recv-Q Send-Q Local Address Foreign Address (State)
tcp 0 0 *:domain *:* LISTEN
tcp 0 0 *:time *:* LISTEN
tcp 0 0 *:smtp *:* LISTEN
tcp 0 0 vlager:smtp vstout:1040 ESTABLISHED
tcp 0 0 *:telnet *:* LISTEN
tcp 0 0 localhost:1046 vbardolino:telnet ESTABLISHED
tcp 0 0 *:chargen *:* LISTEN
tcp 0 0 *:daytime *:* LISTEN
tcp 0 0 *:discard *:* LISTEN
tcp 0 0 *:echo *:* LISTEN
tcp 0 0 *:shell *:* LISTEN
tcp 0 0 *:login *:* LISTEN

This output shows most servers simply waiting for an incoming connection. However, the fourth line shows an incoming SMTP connection from vstout, and the sixth line tells you there is an outgoing telnet connection to vbardolino.[1]

Using the –a flag by itself will display all sockets from all families.

Notes
[1]

You can tell whether a connection is outgoing from the port numbers. The port number shown for the calling host will always be a simple integer. On the host being called, a well-known service port will be in use for which netstat uses the symbolic name such as smtp, found in /etc/services.

Using vmstat for virtutal memory analyze

vmstat, as its name suggests, reports virtual memory statistics. It shows how much virtual memory there is, how much is free and paging activity. Most important, you can observe page-ins and page-outs as they happen. This is extremely useful.

To monitor the virtual memory activity on your system, it's best to use vmstat with a delay. A delay is the number of seconds between updates. If you don't supply a delay, vmstat reports the averages since the last boot and quit. Five seconds is the recommended delay interval.

To run vmstat with a five-second delay, type:

vmstat 5

You also can specify a count, which indicates how many updates you want to see before vmstat quits. If you don't specify a count, the count defaults to infinity, but you can stop output with Ctrl-C.

To run vmstat with ten updates, five seconds apart, type:

vmstat 5 10

Here's an example of a system free of paging activity:

procs memory swap io system cpu
r b w swpd free buff cache si so bi bo in cs us sy id
0 0 0 29232 116972 4524 244900 0 0 0 0 0 0 0 0 0
0 0 0 29232 116972 4524 244900 0 0 0 0 2560 6 0 1 99
0 0 0 29232 116972 4524 244900 0 0 0 0 2574 10 0 2 98

All fields are explained in the vmstat man page, but the most important columns for this article are free, si and so. The free column shows the amount of free memory, si shows page-ins and so shows page-outs. In this example, the so column is zero consistently, indicating there are no page-outs.

The abbreviations so and si are used instead of the more accurate po and pi for historical reasons.

Here's an example of a system with paging activity:

procs memory swap io system --- cpu ---
r b w swpd free buff cache si so bi bo in cs us sy id
. . .
1 0 0 13344 1444 1308 19692 0 168 129 42 1505 713 20 11 69
1 0 0 13856 1640 1308 18524 64 516 379 129 4341 646 24 34 42
3 0 0 13856 1084 1308 18316 56 64 14 0 320 1022 84 9 8

Notice the nonzero so values indicating there is not enough physical memory and the kernel is paging out. You can use top and ps to identify the processes that are using the most memory.

You also can use top to show memory and swap statistics. Here is an example of the uppermost portion of a typical top report:

14:23:19 up 348 days, 3:02, 1 user, load average: 0.00, 0.00, 0.00
55 processes: 54 sleeping, 1 running, 0 zombie, 0 stopped
CPU states: 0.0% user, 2.4% system, 0.0% nice, 97.6% idle
Mem: 481076K total, 367508K used, 113568K free, 4712K buffers
Swap: 1004052K total, 29852K used, 974200K free, 244396K cached

Linux Free Command (Analysing RAM utilization)

I was reading these and thought sharing them will be a useful.

The linux free command allows us to check free/used memory on the system The output below is the result of running free -m on my system (-m means output is in MB):

total used free shared buffers cached
Mem: 3856 1121 2735 0 17 180
-/+ buffers/cache: 923 2933
Swap: 2533 1044 1489

[edit]
Output explained

The first line starting with Mem: gives us the following information:

* total - is the total avaialble RAM (== Physical Memory) after subtracting the amount used by the kernel! In my case I have 4GB RAM and the total displays less than this.
* used - is the part of the RAM that currently has information in it that can be of use to the system (remember: unused RAM is useless, try to maximise this value)
* free - is just total-used
* shared - is the amount of memory shared between processes
* buffers and cached - the cached data and buffers for IO

The second line starting with -/+ buffers/cache: tells us how much of the memory in the buffers/cache is used by the applications and how much is free. Keep in mind that in general the cache is filled with disk IO cached data. The cache can be very easily reclaimed by the OS for applications. Let BUFFERS + CACHED from first line be value X.

X subtracted from the USED memory from the first line gives how much RAM is used by applications (USED value on second line)

X added to the FREE memory on the first line gives how much RAM applications can still request from the OS.

While the first line handles the values of currently used RAM, including applications and caches (but excluding kernel), the second line gives info on application related memory: how much is currently in use and how much is there still available for the applications.

You can find more info here

Using Find output and making a grep on it

Some times, we may be in situation to find the list of files in a recursive directory and search for a specific contents in it.

Below is the command which does that. In below command I'm trying to find commons-beanutils.jar recursive in a directory and a grep command on the listed files to actually find do the jar files has class file 'BeanUtilsBean.class in it.

find . -name *beanutils*.jar -exec grep 'BeanUtilsBean.class' '{}' \;

How to view and change the timestamp of a file say creation date

'stat' command will give the last-accessed/last-modified/file-created date with timestamps in it.

[prakashc@cu120 jbossweb-tomcat50.sar]$ stat commons-beanutils-1.8.0.jar
File: `commons-beanutils-1.8.0.jar'
Size: 231320 Blocks: 464 IO Block: 4096 regular file
Device: 303h/771d Inode: 6547316 Links: 1
Access: (0700/-rwx------) Uid: ( 7069/prakashc) Gid: ( 4001/__cubitu)
Access: 2011-02-09 07:01:55.000000000 +0530
Modify: 2011-02-09 05:50:40.000000000 +0530
Change: 2011-02-09 06:12:08.000000000 +0530

using 'touch' command you can modify the date created

touch commons-beanutils-1.8.0.jar -t [[CC]YY]MMDDhhmm [.SS]

MM - The month of the year [01-12].
DD - The day of the month [01-31].
hh - The hour of the day [00-23].
mm - The minute of the hour [00-59].
CC - The first two digits of the year.
YY - The second two digits of the year.
SS - The second of the minute [00-61].