question on the output of netstat -an?

[Becke]

Hi Team,

On our two HP servers which are identical to each other, I have run netstat command to list port ie 4590 ie

netstat -an|grep 4570
Here is the output of the above
tcp4 0 0 *.4590 *.* LISTEN

The above output means that port 4590 is listening which is normal, however on the other server when i have run the same command i get this which is different from above

# netstat -an|grep 4590
tcp4 0 0 *.4590 *.* LISTEN
f100020004459000 stream
var/ct/IW/soc/mc.0 0 0 0 f100020004fe5700 0 0 /
#########################################

Now in above output the port 4590 is also listneing on the other server but what is the difference, why i get this extra bit of info ie mentioned below on the other server when i run netstat -an|grep 4590???

"f100020004459000 stream
var/ct/IW/soc/mc"

Please advise

Cheers
Raf

[Patrick Wallek · Accepted solution]

It is entirely possible that the extra output would make more sense if you looked at without grep'ing for 4590. Meaning, the lines around that bit of output COULD have something to do with it, but since you are grep'ing you are not seeing everything.

Why don't you try doing a 'netstat -an' (without the grep) and then look through the output for the 'var/ct/IW....' line. And then see if it makes more sense.

[Steven Schweda]

Well, duh. You get the other line because it
includes the characters "4590", which is what
you asked "grep" to look for.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1059420

From the context, I assume that
netstat-an|grep 4570
was really
netstat -an|grep 4590
.

[Becke]

Guys,

Thanks for the quick responses, when i have done ps -eaf|grep on 4590, looks like this port is being used??? please refer the output below

# netstat -an|grep 4590
tcp4 0 0 *.4590 *.* LISTEN
f100020004459000 stream 0 0 0 f100020004fe5700 0 0 /var/ct/IW/soc/mc/RMIBM.LPRM.0
# ps -eaf|grep /var/ct/IW/soc/mc/RM.LPRM
root 483488 507952 0 14:18:57 pts/1 0:00 grep /var/ct/IW/soc/mc/RM.LPRM

[Steven Schweda]

Did you look at this?:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1059420

Did you try this?:

netstat -an | grep '\.4590 '

Did you try it on both systems?

What did you expect to learn from the "ps"?

What's the mystery?

[Patrick Wallek]

Actually your 'ps' command is not showing you anything. If you look closely at the output the only thing being returned is your 'grep' statement.

Have you looked at the whole output of your netstat command?

[Becke]

Thanks Steven&Patrick

I have looked at that thread, and this time I have used the below command with space after 4590,

# netstat -an|grep '.4590 '
tcp4 0 0 *.4590 *.* LISTEN

so it did not pick up the garbage below
ie
f100020004459000 stream
var/ct/IW/soc/mc.0 0 0 0 f100020004fe5700 0 0 /

it means that port 4590 is listening and nothing is using it, and if application can't connect to it then their could be a firewall issue, so i will now contact firewall team to look at....I assume with the help of you guys i have found my answer correct me if im wrong, i will now assign points....we have a great team guys

[Steven Schweda]

> [...] i have found my answer [...]

All you asked about was "netstat" and "grep".
This is the first time that we have heard
anything about your actual problem, so it's
hard to say if you have the answer.

If the problem is not the firewall, then you
might start over at the beginning. Useful
information might include what you are doing
and what goes wrong when you do it.

[Becke]

Hi Steve,

Just to explain you "once again"

Originally I've run command
"netstat -an|grep 4590"

in the output i found that port 4590 was listening but i found some other processes or garbage associated in the output, please refer to that output again

# netstat -an|grep 4590
tcp4 0 0 *.4590 *.* LISTEN
f100020004459000 stream
var/ct/IW/soc/mc.0 0 0 0 f100020004fe5700 0 0 /
#########################################
Please note when i ran it again i have put space after 4570 and it did not pick any other additional garbage, i was a bit puzzled in the first place and thought that this port is in use by something else which i did not expect to see, but when i ran the command below it only displayed that the port is listening but nothing is using it and that's what i wanted to verify as the above netstat command has confused me with some other garbage embedded in the ouput.

netstat -an|grep '.4570 ' ( please note there is a space after 4570 and it doesn't pick up other stuff which was confusing me in the first place)..

I think you are right, you have never understood my original question:), however the link you sent me has helped me resolve my problem.....thanks again for your prompt responses mate...

cya

[Becke]

By the way, i had a typo in my previous post, its actually 4590 instead of 4570

refer to the ouput below, by putting space after 4590, it displays the correct filtered all that rubbish, which has confused me and made me think that this port was in use by something else where I have expected to see it only listening and not being used:)

netstat -an|grep '.4590 '
tcp4 0 0 *.4590 *.* LISTEN

[Steven Schweda]

> [...] you have never understood my
> original question:), [...]

That's one interpretation.

Note also that, as explained above, you
really do want that "\" in the "grep"
command, unless you want more misleading
garbage in your output. For example:

td176> echo '1234570 ' | grep '.4570 '
1234570

td176> echo '1234570 ' | grep '\.4570 '
td176>

td176> echo '123.4570 ' | grep '\.4570 '
123.4570

> [...] confused me with some other garbage
> embedded in the ouput.

But it's only garbage for which you asked.
"grep" looks for character patterns, not for
port numbers as such. (And, without the "\",
you're still asking for some garbage.)

But, if you're happy, ...

[Dennis Handly]

If you want to look for 4590, you should use grep -w 4590. (Assuming you are on 11i.)

Oops, this was all explained on Steven's link.

[Becke]

Thanks Steven and everyone who responded,

Its all pretty clear now guys and I have learned something new like everyone else.

We have a great team here

I will now assin more points

Cheers
Raf