18

I'm trying to use NTP to update the time on my machine. However, it gives me an error:

host # ntpdate ntp1.example.org
10 Aug 12:38:50 ntpdate[7696]: the NTP socket is in use, exiting

What does the error "socket is in use" mean? How can I see what is using this socket?

This happens on my CentOS 4.x system, but I also see it on FreeBSD 7.x, Ubuntu 10.04 and Solaris 10.

Gilles 'SO- stop being evil'
  • 829,060
Stefan Lasiewski
  • 19,754
  • 24
  • 70
  • 85

7 Answers7

20

You can do 

lsof -n | grep -i "TCP\|UDP" | grep -v "ESTABLISHED\|CLOSE_WAIT"

to see all of your listening ports, but dollars to donuts that ntpd is running: 

service ntpd status

And as for "What does socket in use" mean? If I can be forgiven for smoothing over some wrinkles (and for the very basic explanation, apologies of most of this is remedial for you)...TCP/IP (the language of the internet) specifies that each computer has an IP address, which uniquely identifies that computer on the internet. In addition, there are 65,000 numbered ports on each IP address that can be connected to.

When you want to connect to a web server, you open the site in your browser, but the machinery underneath is actually connecting you to port 80 on the web server's IP. The web server's daemon (the program listening for connections to port 80) uses a "socket" to hold open that port, reserving it for itself. Only one program can use the same port at a time.

Since you had ntpd running, it was using that port. 'ntpdate' tried to access that port, but since it was already held open, you got the 'socket already in use' error.

Edit
Changed to account for UDP as well

Matt Simmons
  • 1,070
  • 1
  • 8
  • 14
  • 1
    lsof rocks my world! grep on IPv4 as well to find various IP based things. – geoffc Aug 10 '10 at 19:48
  • "apologies to everyone who already knew this" -- Don't apologize. One purpose of this site is to provide good answers to common questions. The purpose of this early beta is to provide content. – Stefan Lasiewski Aug 10 '10 at 21:06
  • I know, but I wanted to make sure the person asking knew I wasn't trying to talk down to them. – Matt Simmons Aug 10 '10 at 22:56
  • I asked the question, and you weren't talking down to me. I also know the answer, but I figure it's a good question for the beta. And your answer was much better then anything I would write ;) – Stefan Lasiewski Aug 11 '10 at 18:15
  • @MattSimmons there is no Isof command in my CentOS 7. – three-blocks Jul 02 '17 at 13:31
10

You can also use netstat to look for open sockets--it's much cleaner than using lsof as the other posters have suggested. Try this command line as root

netstat -lp -u -t

to view all listening connections, including their associated pid's and programs. The -l parameter is what specifies listening connections, -p specifies that you want to see the PID/name and -t and -u tell netstat that you want only TCP and UDP connections (IPv4 and IPv6).

If you want to see numeric port and host names (ie. not resolved in the case of hosts, and not transformed to service names in the case of ports), you can add -n to the command line above.

EDIT: This works on Linux--I don't know how well it works on BSD, as I don't have any BSD-based boxes around.

B.R.
  • 280
  • 2
  • 6
  • +1 : This is the only answer which actually shows the ntpd process (which listens on UDP by default). – Stefan Lasiewski Aug 10 '10 at 20:58
  • For the humans: Your flags are equivalent to netstat --listen --programs --udp --tcp – Stefan Lasiewski Aug 10 '10 at 20:58
  • 1
    FreeBSD does not support the '-p' ("Show Programs"), which is why people use LSOF. It also does not support the -l ("Show Listening Sockets") flags, but I think you can do that with | grep LISTEN, but that excludes the UDP connections. But otherwise, I think the equivalent flags on FreeBSD are: netstat -p udp -p tcp -a, but netstat -a might be simpler. – Stefan Lasiewski Aug 10 '10 at 21:05
  • @Stefan: My answer will show UDP sockets as well. – kbyrd Aug 10 '10 at 22:34
  • @kbyrd : Interesting. It doesn't show UDP packets for me. See my comment to your post. – Stefan Lasiewski Aug 10 '10 at 22:52
  • @Stefan: That seems so...backwards. :-/ (Re: BSD netstat not supporting -p or -l) – B.R. Aug 11 '10 at 15:11
  • @B : I agree. But I think the original BSD netstat didn't support the flags, therefore the current netstat doesn't introduce that change either. It's very *BSD! – Stefan Lasiewski Aug 11 '10 at 15:29
2

On FreeBSD, you can also use sockstat in case lsof doesn't work for you (e.g. on virtualized systems that don't have /dev/mem for whatever reason). To get a list of all programs with listening IPv4 sockets:

sockstat -l4
diz
  • 121
1

You can use lsof to find which application is using this socket.

Anthon
  • 79,293
txwikinger
  • 2,226
  • 22
  • 27
1

As root, do this:

lsof | grep IPv4 | grep LISTEN

This will show you all processes that are listening on IPv4 sockets. You may want to add -b to prevent lsof from doing some things that might block it. If you do that you'll probably also want to redirect stderr to /dev/null.

Anthon
  • 79,293
kbyrd
  • 1,416
  • 14
  • 18
0

Toying with this three-in-one on OS X 10.9.5:

sudo lsof | grep \ IPv | sort ; clear ; sudo lsof -U ; clear ; sudo netstat -a

Graham Perrin
  • 341
0

With FreeBSD use the -u switch so that ntpdate uses an unprivileged port instead.

Like: ntpdate -v -b -u 0.freebsd.pool.ntp.org

Use man ntpdate to see what -v and -b does.

Raphael Ahrens
  • 9,771
Monti
  • 1
  • The ntpdate on Debian has the -u option, since it's from ntp.org, I imagine most systems have it. – RobertL Nov 04 '15 at 15:58