Workshop

tcp 0 0 frotz.frob.com.telnet 200.1.1.34.1444 ESTABLISHED
tcp 0 0 frotz.frob.com.telnet 200.1.1.35.2855 ESTABLISHED
I’ve included the column headings for clarity; you wouldn’t actually get them when searching for an
address. It becomes apparent very quickly that people from the 200.1.1 network are in, and they’re working
just fine. (Actually, you could have used the who command, which, on most UNIX machines, tells you who is
logged in and where they are logged in from. However, netstat will show you any service, not just Telnet.)
You now know that people from 200.1.1.0 are logged into the system, and you suspect that the user’s
problem is workstation related.
proto is the protocol. In most cases, it will be tcp or udp, TCP being the equivalent of a phone call (circuit
oriented) and UDP being the equivalent of tossing notes back and forth to each other (connectionless). You
can find more on UDP in Hour 15, “Firewall and Proxy Server Basics,” and Hour 18, “Lots of Different
People in Your Neighborhood: In-Depth Application Troubleshooting.”
send-q and recv-q are representations of holding places for sending and receiving data in the host’s
memory. You can think of them just the way you do a print queue; they hold stuff while waiting for
processing. Unlike a print queue, they typically will be empty during normal operation. That is, these values
will typically be 0 for local area networks, because local nets move pretty fast.
What if they’re not zero? Well, a changing “send queue” can mean that the other end is processing data but is
keeping up somehow. This is usually a normal state for a LAN print server; it really is a print queue, so it
processes some data, then catches up, gets some more data, and keeps going. If you see a nonchanging, nonzero
send queue for one socket but not others, it usually means that something on the other end has stopped
accepting data.
A non-zero receive queue can mean that something on the UNIX host itself is running out of resources, and
it’s temporarily unable to process the incoming data. In practice, this is relatively rare.
The local address is, of course, the server you’re typing netstat on. In this case, because we’re discussing
the Telnet service, the full address with extension is wefrotz. frobozz.com.telnet. Had we used
netstat -an, it would have shown something like 192.168.55.10.23 (Telnet being socket 23). The
foreign address is the other address—the client machine. The socket doesn’t matter as much here—just about
any high-numbered socket that isn’t already in use can be used on the client side.
You can count the number of client/server sockets in use at any given time, say, for an imap mail server, by
typing this:
netstat -a | grep imap | wc -l