Not sure if this is exactly what you need, but here's netstat for HP-UX.

uname -srv

HP-UX B.10.20 A

netstat -np tcp

tcp: 2763301 packets sent 930771 data packets (624793792 bytes) 713 data packets (957508 bytes) retransmitted 1216788 ack-only packets (107037 delayed) 0 URG only packets 0 window probe packets 0 window update packets 615029 control packets 2932146 packets received 1742996 acks (for 615692641 bytes) 65419 duplicate acks 0 acks for unsent data 1104985 packets (75993691 bytes) received in-sequence 1562 completely duplicate packets (1824 bytes) 0 packets with some dup. data (0 bytes duped) 54176 out-of-order packets (0 bytes) 0 packets (0 bytes) of data after window 0 window probes 32788 window update packets 3 packets received after close 0 discarded for bad checksums 0 discarded for bad header offset fields 0 discarded because packet too short 54177 connection requests 499971 connection accepts 554130 connections established (including accepts) 585205 connections closed (including 41 drops) 16 embryonic connections dropped 1720424 segments updated rtt (of 1781132 attempts) 7259 retransmit timeouts 0 connections dropped by rexmit timeout 0 persist timeouts 5403 keepalive timeouts 1993 keepalive probes sent 0 connections dropped by keepalive

On 4/19/06, Henrik Stoerner <henrik at hswn.dk> wrote:

I'm only interested in TCP ports. I have the data I need for Linux, Solaris and the BSD variants, but I would like them also for AIX, HP-UX, Darwin and OSF/1.

So I need:

• The "netstat" command to run to get the set of TCP ports currently in use, including ports used for incoming connections. Typically this will be some sort of "netstat -na", with some extra options to get only the TCP sockets. Note that it may be necessary to run two commands to get both IPv4 and IPv6 ports. On the BSD's, I noticed that connections to the loopback interface register as IPv6 sockets, not IPv4.

• A sample of the output, so I can see which columns the various data go into.

Anyone there who could get me this info ?

Thanks, Henrik

phoebus_ROOT~# uname -a OSF1 phoebus V4.0 1229 alpha

phoebus_ROOT~# netstat -an printing 1 hashtable with 512 buckets Active Internet connections (including servers) Proto Recv-Q Send-Q Local Address Foreign Address (state) tcp 0 0 194.57.34.158.3494 129.175.64.15.631
ESTABLISHED tcp 0 4 194.57.34.158.23 129.175.65.105.4017
ESTABLISHED tcp 0 0 127.0.0.1.4005 127.0.0.1.2301 TIME_WAIT tcp 0 0 127.0.0.1.4006 127.0.0.1.2301 TIME_WAIT tcp 0 0 127.0.0.1.4007 127.0.0.1.2301 TIME_WAIT tcp 0 0 127.0.0.1.4008 127.0.0.1.2301 TIME_WAIT tcp 0 0 127.0.0.1.4009 127.0.0.1.2301 TIME_WAIT tcp 0 0 127.0.0.1.4010 127.0.0.1.2301 TIME_WAIT tcp 0 0 *.6000 *.* LISTEN tcp 0 0 *.1032 *.* LISTEN tcp 0 0 *.1700 *.* LISTEN tcp 0 0 *.631 *.* LISTEN tcp 0 0 *.1030 *.* LISTEN tcp 0 0 *.1029 *.* LISTEN tcp 0 0 *.6112 *.* LISTEN tcp 0 0 *.10402 *.* LISTEN tcp 0 0 *.10401 *.* LISTEN tcp 0 0 *.79 *.* LISTEN tcp 0 0 *.512 *.* LISTEN tcp 0 0 *.513 *.* LISTEN tcp 0 0 *.514 *.* LISTEN tcp 0 0 *.23 *.* LISTEN tcp 0 0 *.21 *.* LISTEN tcp 0 0 *.2301 *.* LISTEN tcp 0 0 *.30000 *.* LISTEN tcp 0 0 *.25 *.* LISTEN tcp 0 0 127.0.0.1.1025 *.* LISTEN tcp 0 0 194.57.34.158.1025 *.* LISTEN tcp 0 0 127.0.0.1.1024 *.* LISTEN tcp 0 0 194.57.34.158.1024 *.* LISTEN tcp 0 0 *.111 *.* LISTEN

Henrik Stoerner wrote:

I'm merging some code I got 6 months ago for checking the "netstat" output for what ports are being used - both for active connections and listen-ports.

For that, I need the "netstat" commands to put into the client code, and an example of the output so I can tell the client-module how to interpret the data.

I'm only interested in TCP ports. I have the data I need for Linux, Solaris and the BSD variants, but I would like them also for AIX, HP-UX, Darwin and OSF/1.

So I need:

• The "netstat" command to run to get the set of TCP ports currently in use, including ports used for incoming connections. Typically this will be some sort of "netstat -na", with some extra options to get only the TCP sockets. Note that it may be necessary to run two commands to get both IPv4 and IPv6 ports. On the BSD's, I noticed that connections to the loopback interface register as IPv6 sockets, not IPv4.

• A sample of the output, so I can see which columns the various data go into.

Anyone there who could get me this info ?

Thanks, Henrik

PS: This lets you setup rules in hobbit-clients to track eg the number of connections to your webserver, and put this into a graph so you can see the activity over the day. It can also alert you if there is a port 25 open on a server where it shouldn't be, or if the number of connections to your ssh daemon goes above 20.

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

--

Stephane Caminade Administrateur Systèmes et Réseau \ <Stephane.Caminade at medoc-ias.u-psud.fr> Institut d'Astrophysique Spatiale / tel : (33) (1) 69 85 87 03 Batiment 121, Universite Paris XI \ fax : (33) (1) 69 85 86 75 F-91405 ORSAY Cedex / www : http://www.medoc-ias.u-psud.fr/

Hi Henrik,

here is the output of "netstat -an" for AIX 5.3 and AIX 5.2. You might want to use something like netstat -an | tail +2 | egrep ^\(tcp\|Proto\) to sort out the first line, keep the second, sort out UDP traffic and the socket stuff. AIX netstat does not seem to provide this using flags :-(

Regards, Mirko

$ uname -an AIX hostname 3 5 00C4E1CA4C00 $ oslevel -r 5300-01 $ netstat -an Active Internet connections (including servers) Proto Recv-Q Send-Q Local Address Foreign Address (state) tcp4 0 0 *.21 *.* LISTEN tcp4 0 0 *.22 *.* LISTEN tcp 0 0 *.80 *.* LISTEN tcp 0 0 *.443 *.* LISTEN tcp4 0 0 *.523 *.* LISTEN tcp4 0 0 *.657 *.* LISTEN tcp4 0 0 *.50002 *.* LISTEN tcp4 0 0 *.50006 *.* LISTEN tcp4 0 0 127.0.0.1.1984 *.* LISTEN tcp4 0 0 10.2.30.163.22 10.2.20.58.45801 ESTABLISHED tcp4 0 0 127.0.0.1.6010 *.* LISTEN tcp 0 0 *.11116 *.* LISTEN tcp 0 0 *.11117 *.* LISTEN tcp 0 0 *.11118 *.* LISTEN tcp 0 0 127.0.0.1.8005 *.* LISTEN tcp4 0 0 127.0.0.1.50002 127.0.0.1.52375 ESTABLISHED tcp 0 0 127.0.0.1.52375 127.0.0.1.50002 ESTABLISHED tcp4 0 0 127.0.0.1.50002 127.0.0.1.52376 ESTABLISHED ... ... udp4 0 0 127.0.0.1.123 *.* udp4 0 0 10.2.30.163.123 *.* ... Active UNIX domain sockets SADR/PCB Type Recv-Q Send-Q Inode Conn Ref s Nextref Addr f1000d0000da5800 stream 0 0 0 f1000d00002a7e80 0 0 f1000d0000db5180 f1000d0000997c00 dgram 0 0 f1000c00213c03f8 0 0 0 /dev/.SRC-unix/SRC22UkEd f1000d0000992b80 f1000d0000989c00 dgram 0 0 f1000c00213d4bf8 0 0 0 /dev/.SRC-unix/SRC56UkEh ... ...

This message was sent using IMP, the Internet Messaging Program.