Determining what process is bound to a port

Question

I know that using the command:

lsof -i TCP

(or some variant of parameters with lsof) I can determine which process is bound to a particular port. This is useful say if I'm trying to start something that wants to bind to 8080 and some else is already using that port, but I don't know what.

Is there an easy way to do this without using lsof? I spend time working on many systems and lsof is often not installed.

score 156 · Answer 1 · answered Mar 14 '11 at 20:48

156

netstat -lnp will list the pid and process name next to each listening port. This will work under Linux, but not all others (like AIX.) Add -t if you want TCP only.

# netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:24800           0.0.0.0:*               LISTEN      27899/synergys
tcp        0      0 0.0.0.0:8000            0.0.0.0:*               LISTEN      3361/python
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      2264/mysqld
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      22964/apache2
tcp        0      0 192.168.99.1:53         0.0.0.0:*               LISTEN      3389/named
tcp        0      0 192.168.88.1:53         0.0.0.0:*               LISTEN      3389/named

etc.

answered Mar 14 '11 at 20:48

Cakemox

1,951

Cool, thanks. Looks like that that works under RHEL, but not under Solaris (as you indicated). Anybody know if there's something similar for Solaris? – Mar 14 '11 at 21:01
netstat -p above is my vote. also look at lsof. – Rich Homolka Mar 15 '11 at 19:56
As an aside, for windows it's similar: netstat -aon | more – Jonathan Aug 26 '14 at 18:50
What about for SCTP? – sudo May 25 '17 at 02:24

score 14 · Answer 2 · answered Mar 15 '11 at 13:27

Another tool available on Linux is ss. From the ss man page on Fedora:

NAME
       ss - another utility to investigate sockets
SYNOPSIS
       ss [options] [ FILTER ]
DESCRIPTION
       ss is used to dump socket statistics. It allows showing information 
       similar to netstat. It can display more TCP and state informations  
       than other tools.

Example output below - the final column shows the process binding:

[root@box] ss -ap
State      Recv-Q Send-Q      Local Address:Port          Peer Address:Port
LISTEN     0      128                    :::http                    :::*        users:(("httpd",20891,4),("httpd",20894,4),("httpd",20895,4),("httpd",20896,4)
LISTEN     0      128             127.0.0.1:munin                    *:*        users:(("munin-node",1278,5))
LISTEN     0      128                    :::ssh                     :::*        users:(("sshd",1175,4))
LISTEN     0      128                     *:ssh                      *:*        users:(("sshd",1175,3))
LISTEN     0      10              127.0.0.1:smtp                     *:*        users:(("sendmail",1199,4))
LISTEN     0      128             127.0.0.1:x11-ssh-offset                  *:*        users:(("sshd",25734,8))
LISTEN     0      128                   ::1:x11-ssh-offset                 :::*        users:(("sshd",25734,7))

score 14 · Answer 3 · answered Mar 15 '11 at 13:33

14

On AIX, netstat & rmsock can be used to determine process binding:

[root@aix] netstat -Ana|grep LISTEN|grep 80
f100070000280bb0 tcp4       0      0  *.37               *.*        LISTEN
f1000700025de3b0 tcp        0      0  *.80               *.*        LISTEN
f1000700002803b0 tcp4       0      0  *.111              *.*        LISTEN
f1000700021b33b0 tcp4       0      0  127.0.0.1.32780    *.*        LISTEN

# Port 80 maps to f1000700025de3b0 above, so we type:
[root@aix] rmsock f1000700025de3b0 tcpcb
The socket 0x25de008 is being held by process 499790 (java).

answered Mar 15 '11 at 13:33

frielp

480

1

Thanks for this! Is there a way, however, to just display what process listen on the socket (instead of using rmsock which attempt to remove it) ? – Olivier Dulac Sep 18 '13 at 04:05
2

@OlivierDulac: "Unlike what its name implies, rmsock does not remove the socket, if it is being used by a process. It just reports the process holding the socket." (https://www.ibm.com/developerworks/community/blogs/cgaix/entry/rmsock?lang=en) – Vitor Py Sep 26 '13 at 14:18
@vitor-braga: Ah thx! I thought it was trying but just said which process holds in when it couldn't remove it. Apparently it doesn't even try to remove it when a process holds it. That's cool! Thx! – Olivier Dulac Sep 26 '13 at 16:00
For those looking for the rmsock link this is the updated version http://gibsonnet.net/blog/cgaix/html/rmsock%20on%20AIX..html – Alexis Tyler Sep 25 '21 at 00:12

score 3 · Answer 4 · answered Mar 14 '11 at 23:47

3

For Solaris you can use pfiles and then grep by sockname: or port:.

A sample (from here):

pfiles `ptree | awk '{print $1}'` | egrep '^[0-9]|port:'

answered Mar 14 '11 at 23:47

Eugen Constantin Dinca

131

score 2 · Answer 5 · answered May 08 '11 at 14:40

2

I was once faced with trying to determine what process was behind a particular port (this time it was 8000). I tried a variety of lsof and netstat, but then took a chance and tried hitting the port via a browser (i.e. http://hostname:8000/). Lo and behold, a splash screen greeted me, and it became obvious what the process was (for the record, it was Splunk).

One more thought: "ps -e -o pid,args" (YMMV) may sometimes show the port number in the arguments list. Grep is your friend!

answered May 08 '11 at 14:40

rickumali

411
3
5

In the same vein, you could telnet hostname 8000 and see if the server prints a banner. However, that's mostly useful when the server is running on a machine where you don't have shell access, and then finding the process ID isn't relevant. – Gilles 'SO- stop being evil' May 08 '11 at 14:45

Determining what process is bound to a port

5 Answers5

Linked