View TCP Listeners Information

About this task

Perform this procedure to view a detailed list of systems that are in the listening state.

When a connection is in the listen state an end point system is waiting for a returning handshake (SYN).The normal listening state should be very transient, changing all of the time. Two or more systems going to a common system in an extended listening state indicates the need for further investigation. End systems in an extended listening state can indicate a broken TCP connection or a DOS attack on a resource. This type of DOS attack, known as a SYN attack, results from the transmission of SYNs with no response to return replies. While many systems can detect a SYN attack, the TCP listener statistics can provide additional forensic information.

Procedure

  1. In the navigation pane, expand Configuration > IP.
  2. Select TCP/UDP.
  3. Select the TCP Listeners tab.

TCP Listeners Field Descriptions

Use the data in the following table to use the TCP Listeners tab.

Name

Description

LocalAddressType

Displays the type (IPv6 or IPv4) for the address in the LocalAddress field.

LocalAddress

Displays the IPv6 address for the TCP connection.

LocalPort

Displays the local port number for the TCP connection.

Process

Displays the process ID for the system process associated with the TCP connection.