# Netstat monitoring for connection status and source IP

**URL:** <https://community.dynatrace.com/t/netstat-monitoring-for-connection-status-and-source-ip/45405>\
**Category:** Real User Monitoring\
**Tags:** application-monitoring, user-sessions\
**Created:** [May 2, 2024, 9:45am UTC](https://community.dynatrace.com/t/netstat-monitoring-for-connection-status-and-source-ip/45405 "2024-05-02T09:45:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rishisingh1210](https://avatars.discourse-cdn.com/v4/letter/r/e0b2c6/32.png) [@rishisingh1210](https://community.dynatrace.com/u/rishisingh1210)\
**Post date:** [May 2, 2024, 9:45am UTC](https://community.dynatrace.com/t/netstat-monitoring-for-connection-status-and-source-ip/45405/1 "2024-05-02T09:45:47Z")

</div>

Hello Folks

How can I monitoring something like netstat on Linux host i.e

Somthing like source address and if connection is established or not ?

Proto Local Address Foreign Address State  
TCP:52606 ec2-54-81-72-134:https ESTABLISHED  
TCP 53652 93:https ESTABLISHED  
TCP :53712 ec2-52-210-196-187:https ESTABLISHED

---

<div class="post-metadata">

**Author:** ![AntonioSousa](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/antoniosousa/32/50_2.png) [@AntonioSousa](https://community.dynatrace.com/u/AntonioSousa)\
**Post date:** [May 2, 2024, 7:07pm UTC](https://community.dynatrace.com/t/netstat-monitoring-for-connection-status-and-source-ip/45405/2 "2024-05-02T19:07:06Z")

</div>

[@rishisingh1210](https://community.dynatrace.com/user/74423),

Some of the information is grabbed by the network module. It includes things like connections refused & timed out, even lower level things like retransmissions. It is even grabbed at the process level. Is has been very useful to me, and had a very big use case last month. You might need to get in more details at the server/network level, but it is very helpful.

What you are asking for is an “audit like” level of all connections in a server. They can be huge! You could eventually ingest them as logs, but what would be the use case besides an audit?

Another option might be to use eBPF, and you can get some inspiration n this article: [https://netflixtechblog.com/how-netflix-uses-ebpf-flow-logs-at-scale-for-network-insight-e3ea997dca96?gi=4d0cb6c52b73](https://netflixtechblog.com/how-netflix-uses-ebpf-flow-logs-at-scale-for-network-insight-e3ea997dca96?gi=4d0cb6c52b73)  
Don’t know anyone that has done this in Dynatrace though.

Finally, I once saw an offering based on Gigamon. Not sure if it does what you need, but check it out at:

> **[Gigamon Deep Observability Pipeline monitoring & observability | Dynatrace Hub](https://www.dynatrace.com/hub/detail/gigamon-hawk-deep-observability-pipeline/)**
>
> The Gigamon Deep Observability Pipeline harnesses actionable network-level intelligence to amplify the power of Dynatrace. Start your free trial today!