7/7/2017 https://emcservice.force.com/CustomersPartners/KB_BreakFix_Printable?

id=kA2j0000000QoXbCAK

Level 50 = Restricted
Restricted View

Knowledge Base Article: 000400184

Analyzing netstat output(000400184)
Primary Product
Product NetWorker Client for Linux 7.6, NetWorker Client for Linux 7.5.1, NetWorker Client for Linux 7.5, NetWorker Client for Linux 7.4.5, NetWorker Client for Unix
7.6, NetWorker Client for Unix 7.5.2, NetWorker Client for Unix 7.5.1

Audience: Level 40 = Employees and Last Published: Sat Feb 20 23:41:51 GMT
Version: 2 Article Type: Break Fix
Partners 2016
Summary:

Issue:

Notes: Symptoms

Analyze netstat output

How to use netstat
Troubleshoot network issues
Backup slow
Backup hangs
Poor performance
Error: CLOSE_WAIT
Error: TIME_WAIT

Resolution
Slow backups or hangs can be caused by poor network performance. One tool to investigate network
performance on Windows and UNIX is netstat.

The netstat command displays list of TCP connections and states. Common states are LISTENING,
ESTABLISHED, TIME_WAIT. Having connections in FIN_WAIT_2 or CLOSE_WAIT for longer than a few
https://emcservice.force.com/CustomersPartners/KB_BreakFix_Printable?id=kA2j0000000QoXbCAK 1/7
7/7/2017 https://emcservice.force.com/CustomersPartners/KB_BreakFix_Printable?id=kA2j0000000QoXbCAK

seconds, or having many of these connections may indicate network problems.

netstat -a
-----------
TCP ANT:sunrpc ANT:0 LISTENING
TCP ANT:epmap ANT:0 LISTENING
TCP ANT:1061 mail:2190 ESTABLISHED
TCP ANT:1065 mail:2198 ESTABLISHED
TCP ANT:1110 ddtsres:http TIME_WAIT
TCP ANT:1117 google:http CLOSE_WAIT

or

netstat -an"findstr WAIT (to look only for WAIT)

TCP ANT:1110 ddtsres:http TIME_WAIT

TCP ANT:1117 google:http CLOSE_WAIT

This is an example from Windows host, ANT, showing that there are connections (TCP sockets) open to
mail, ddtsres, google. The ESTABLISHED sockets are exchanging data normally. The TIME_WAIT status
for the ddtsres socket means that ANT and ddtsres have agreed to closed the socket, likely because ANT is
no longer accessing DDTS, but incase any leftover packets arrive for the socket, the socket stays in
TIME_WAIT status for a specified interval.

The CLOSE_WAIT status means that ANT received a request to close the connection (FIN) from google,
and has responded with AWK(FIN). Now ANT is waiting for google to ACKnowledge receipt of his
AWK(FIN). Once this is Acknowledged, then the session will go into TIME_WAIT.

It is normal to see some sessions in CLOSE_WAIT or TIME_WAIT, but if there are accumulated sessions,
or, if the sessions never close, dropped the Acknowledgements-packets (due to too much traffic), or the the
other host never sent one (due to its own hanging).

TCP Sockets States:

The possible state values for TCP sockets are as follows:

BOUND
Bound, ready to connect or listen.
CLOSED
Closed. The socket is not being used.
CLOSING
Closed, then remote shutdown; awaiting acknowledgment.
https://emcservice.force.com/CustomersPartners/KB_BreakFix_Printable?id=kA2j0000000QoXbCAK 2/7
7/7/2017 https://emcservice.force.com/CustomersPartners/KB_BreakFix_Printable?id=kA2j0000000QoXbCAK
Closed, then remote shutdown; awaiting acknowledgment.
CLOSE_WAIT
Remote shutdown; waiting for the socket to close.
ESTABLISHED
Connection has been established.
FIN_WAIT_1
Socket closed; shutting down connection.
FIN_WAIT_2
Socket closed; waiting for shutdown from remote.
IDLE
Idle, opened but not bound.
LAST_ACK
Remote shutdown, then closed; awaiting acknowledgment.
LISTEN
Listening for incoming connections.
SYN_RECEIVED
Initial synchronization of the connection under way.
SYN_SENT
Actively trying to establish connection.
TIME_WAIT
Wait after close for remote shutdown retransmission.

Useful commands:
C:\>netstat -e
Interface Statistics

Received Sent

Bytes 57223457 15416330

Unicast packets 40518 43270
Non-unicast packets 124368 129
Discards 0 0
Errors 0 0
Unknown protocols 26185
Statistics since 7/2/2002 7:37 AM

# netstat -i
Name Mtu Net/Dest Address Ipkts Ierrs Opkts Oerrs Collis Queue
lo0 8232 loopback localhost 259226084 0 259226084 0 0 0
hme0 1500 sunrise.legato.com sunrise.legato.com 35046258 0 30320533 0 0 0

Name Mtu Net/Dest Address Ipkts Ierrs Opkts Oerrs Collis

lo0 8252 localhost localhost 259226104 0 259226104 0 0
hme0 1500 fe80::a00:20ff:fef8:749d/10 fe80::a00:20ff:fef8:749d 35046258 0 30320533 0 0

https://emcservice.force.com/CustomersPartners/KB_BreakFix_Printable?id=kA2j0000000QoXbCAK 3/7
7/7/2017 https://emcservice.force.com/CustomersPartners/KB_BreakFix_Printable?id=kA2j0000000QoXbCAK

# netst.at -i 1 <-----Interval
input hme0 output input (Total) output
packets errs packets errs colls packets errs packets errs colls
35121008 0 30386382 0 0 295261709 0 290527083 0 0
130 0 118 0 0 1760 0 1748 0 0
127 0 118 0 0 1763 0 1754 0 0
133 0 116 0 0 1722 0 1705 0 0
136 0 117 0 0 1755 0 1736 0 0
90 0 82 0 0 1197 0 1189 0 0
131 0 115 0 0 1719 0 1703 0 0
128 0 118 0 0 1750 0 1740 0 0

Additionally for Windows, the "net statistics workstation" command:

C:\>net statistics workstation

Workstation Statistics for \\XANTH

Bytes received 1231831

Server Message Blocks (SMBs) received 4199
Bytes transmitted 11801407
Server Message Blocks (SMBs) transmitted 4197
Read operations 70
Write operations 2
Raw reads denied 0
Raw writes denied 0

Network errors 0
Connections made 12
Reconnections made 0
Server disconnects 7

Sessions started 34
Hung sessions 0
Failed sessions 0
Failed operations 0
Use count 40
Failed use count 14

The command completed successfully.

# netstat -a <-----all information

UDP: IPv4
https://emcservice.force.com/CustomersPartners/KB_BreakFix_Printable?id=kA2j0000000QoXbCAK 4/7
7/7/2017 https://emcservice.force.com/CustomersPartners/KB_BreakFix_Printable?id=kA2j0000000QoXbCAK

Local Address Remote Address State

-------------------- -------------------- -------
*.* Unbound
*.sunrpc Idle
*.* Unbound
*.32771 Idle
*.sunrpc Idle
*.* Unbound
*.32775 Idle
*.name Idle
*.biff Idle
*.talk Idle
*.time Idle
*.echo Idle
*.discard Idle
*.daytime Idle
*.chargen Idle
*.32777 Idle
*.32778 Idle
...

UDP: IPv6
Local Address Remote Address State If
---------------------------------
*.* Unbound
*.sunrpc Idle
*.* Unbound
*.32771 Idle
*.time Idle
*.echo Idle
*.discard Idle
*.daytime Idle
*.chargen Idle
*.32777 Idle
*.32779 Idle
*.32781 Idle
...

TCP: IPv4
Local Address Remote Address Swind Send-Q Rwind Recv-Q State
-------------------- -------------------- ----- ------ ----- ------ -------
*.* *.* 0 0 24576 0 IDLE
*.sunrpc *.* 0 0 24576 0 LISTEN
https://emcservice.force.com/CustomersPartners/KB_BreakFix_Printable?id=kA2j0000000QoXbCAK 5/7
7/7/2017 https://emcservice.force.com/CustomersPartners/KB_BreakFix_Printable?id=kA2j0000000QoXbCAK

*.* *.* 0 0 24576 0 IDLE

*.sunrpc *.* 0 0 24576 0 LISTEN
*.* *.* 0 0 24576 0 IDLE
*.ftp *.* 0 0 24576 0 LISTEN
*.telnet *.* 0 0 24576 0 LISTEN
*.shell *.* 0 0 24576 0 LISTEN
*.shell *.* 0 0 24576 0 LISTEN
*.login *.* 0 0 24576 0 LISTEN
*.exec *.* 0 0 24576 0 LISTEN
*.exec *.* 0 0 24576 0 LISTEN
*.uucp *.* 0 0 24576 0 LISTEN
*.finger *.* 0 0 24576 0 LISTEN
*.time *.* 0 0 24576 0 LISTEN
...

TCP: IPv6
Local Address Remote Address Swind Send-Q
Rwind Recv-Q State If
--------------------------------- --------------------------------- ----- ------
*.* *.* 0 0
24576 0 IDLE
*.sunrpc *.* 0 0
24576 0 LISTEN
*.* *.* 0 0
24576 0 IDLE
*.ftp *.* 0 0
24576 0 LISTEN
*.telnet *.* 0 0
24576 0 LISTEN
*.shell *.* 0 0
...

Product: NetWorker Client for Linux 7.6, NetWorker Client for Linux 7.5.1, NetWorker Client for Linux 7.5, NetWorker
Client for Linux 7.4.5, NetWorker Client for Unix 7.6, NetWorker Client for Unix 7.5.2, NetWorker Client for
Unix 7.5.1, NetWorker Client for Unix 7.5, NetWorker Client for Unix 7.4.5, NetWorker Client for Windows
7.6, NetWorker Client for Windows 7.5.2, NetWorker Client for Windows 7.5.1, NetWorker Client for
Windows 7.5, NetWorker Client for Windows 7.4.5, NetWorker Server for Unix 7.6, NetWorker Server for
Unix 7.5.2, NetWorker Server for Unix 7.5, NetWorker Server for Unix 7.4.5, NetWorker Server for Linux
7.6, NetWorker Server for Linux, NetWorker Client for Linux 7.6, NetWorker Client for Linux 7.5.1,
NetWorker Client for Linux 7.5, NetWorker Client for Linux 7.4.5, NetWorker Client for Linux 7.4.4,
NetWorker Client for Linux 7.4.3, NetWorker Client for Linux 7.4, NetWorker Client for Linux 7.3.4,
NetWorker Client for Linux 7.3.1, NetWorker Client for Unix 7.6, NetWorker Client for Unix 7.5.2, NetWorker
Client for Unix 7.5.1, NetWorker Client for Unix 7.5, NetWorker Client for Unix 7.4.5, NetWorker Client for
https://emcservice.force.com/CustomersPartners/KB_BreakFix_Printable?id=kA2j0000000QoXbCAK 6/7
7/7/2017 https://emcservice.force.com/CustomersPartners/KB_BreakFix_Printable?id=kA2j0000000QoXbCAK
Client for Unix 7.5.1, NetWorker Client for Unix 7.5, NetWorker Client for Unix 7.4.5, NetWorker Client for
Unix 7.4.4, NetWorker Client for Unix 7.4.3, NetWorker Client for Unix 7.4, NetWorker Client for Unix 7.3.4,
NetWorker Client for Unix 7.3.1, NetWorker Client for Windows 7.6, NetWorker Client for Windows 7.5.2,
NetWorker Client for Windows 7.5.1, NetWorker Client for Windows 7.5, NetWorker Client for Windows
7.4.5, NetWorker Client for Windows 7.4.4, NetWorker Client for Windows 7.4.3, NetWorker Client for
Windows 7.4, NetWorker Client for Windows 7.3.4, NetWorker Client for Windows 7.3.1, NetWorker Server
for Unix 7.6, NetWorker Server for Unix 7.5.2, NetWorker Server for Unix 7.5, NetWorker Server for Unix
7.4.5, NetWorker Server for Unix 7.4.4, NetWorker Server for Unix 7.4.3, NetWorker Server for Unix 7.4,
NetWorker Server for Unix 7.3.4, NetWorker Server for Unix 7.3.1, NetWorker 7.3.1, NetWorker 7.3.4,
NetWorker 7.4, NetWorker 7.4.3, NetWorker 7.4.4, NetWorker 7.4.5, NetWorker 7.5, NetWorker 7.5.2,
NetWorker 7.6, NetWorker 7.5.1, NetWorker

Problem Code: Corrective Maintenance

Article Properties: Validation Status: Approved Original Create Date: Sat Feb 20 12:59:29 GMT 2016
Channels: First Published: Fri Feb 05 17:42:21 GMT 2016
Originally Created By: SFDC Admin Last Modified: Sat Feb 20 23:41:51 GMT 2016

https://emcservice.force.com/CustomersPartners/KB_BreakFix_Printable?id=kA2j0000000QoXbCAK 7/7