Your Ad Here

IBM AIX/UNIX system storage administration ksh/perl scripting

Friday, March 20, 2009

Using netstat and rmsock to Identify Processes Using the Default Gateway


Is there a way to use netstat to find processes that are heavily using the default gateway?


You can use netstat and rmsock in combination to help find processes that are actively using the default gateway.

If path MTU discover is not enabled then temporarily enable it so you can get more information when using netstat. These are commands to enable the path MTU discover:

no -o tcp_pmtu_discover=1
no -o udp_pmtu_discover=1

The next step involves running netstat -rn and looking for the highest use count on the cloned route entries (those with a W flag - reference example 1).

Example 1

$ netstat -rn | grep -E "Use|UGHW"
Destination Gateway Flags Refs Use If PMTU Exp
Groups UGHW 1 7 en2 - - UGHW 2 123 en2 - - UGHW 1 5 en2 1500 - UGHW 1 3 en2 - - UGHW 1 3373 en2 1500 -

In example 1 above, the destination address has the highest use count (3373).

Next, check for any active sockets related to IP address using the netstat -Aan command (see example 2):

Example 2

$ netstat -Aan | grep
705b21e4 tcp4 0 0 ESTABLISHED

Use the process control block address (705b21e4) from the netstat -Aan output in example 2 with the rmsock command to find a process ID associated with the socket.

Example 3

# rmsock 705b21e4 tcpcb
The socket 0x705b2000 is being held by proccess 9394 (smbd).

With the help of netstat and rmsock in the preceding three examples, you were able to find a specific smbd process that had the most activity relative to sending data over the default gateway.


Juan Alvarez said...

netstat -Aan | grep LISTEN | awk '{print "echo puerto:"$5";rmsock "$1" tcpcb"}' | ksh

jake george said...

Data Warehousing Online Training, ONLINE TRAINING – IT SUPPORT – CORPORATE TRAINING The 21st Century Software Solutions of India offers one of the Largest conglomerations of Software Training, IT Support, Corporate Training institute in India - +919000444287 - +917386622889 - Visakhapatnam,Hyderabad Data Warehousing Online Training, Data Warehousing Training, Data Warehousing, Data Warehousing Online Training| Data Warehousing Training| Data Warehousing| "Courses at 21st Century Software Solutions
Talend Online Training -Hyperion Online Training - IBM Unica Online Training - Siteminder Online Training - SharePoint Online Training - Informatica Online Training - SalesForce Online Training - Many more… | Call Us +917386622889 - +919000444287 -

Nasreen Basu said...

excellent piece of information, I had come to know about your website from my friend kishore, pune,i have read atleast 8 posts of yours by now, and let me tell you, your site gives the best and the most interesting information. This is just the kind of information that i had been looking for, i'm already your rss reader now and i would regularly watch out for the new posts, once again hats off to you! Thanx a lot once again, Regards, obiee training in hyderabad,informatica training in hyderabad


Blog Archive