Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using a Red Hat virtual machine, accessible only remotely. However when I use the top command, one of the displayed processes taking up the most memory is firefox, located at /usr/lib64/firefox-3.0.18/firefox.

How could such a process be launched without a display, and could it be actually used by some processes? Is there a way to check which processes are using it?

share|improve this question
Are you the only person with access to that machine? If it's visible from the web, it have been compromised and someone might be running firefox via ssh with X forwarding. Check who, netstat -n and lsof | grep firefox. – rozcietrzewiacz Oct 25 '11 at 9:00
Which virtualization software are you using? In VMWare, for example, virtual machines still have a display, even if nobody is connected via a virtual console. – andyortlieb Oct 26 '11 at 4:02
VMWare indeed. Thank you @rozcietrzewiacz for these useful commands! – Dunaril Oct 26 '11 at 11:59
up vote 5 down vote accepted

Firefox needs an X display. This doesn't have to be a physical display on the machine where it's running: it can be a remote or virtual display.

If you want to know where it's displaying, look at the DISPLAY environment variable in the Firefox process. Note that you'll need to be root (or more precisely to have the permissions of the user running the firefox process).

</proc/$pid/environ grep -z '^DISPLAY='

If the value is of the form :NUMBER (beginning with a colon), the X server is local. There will be a socket called /tmp/.X11-unix/XNUMBER, e.g. /tmp/.X11-unix/X42 for DISPLAY=:42. If the display is of the form :NUMBER1.NUMBER2, ignore the .NUMBER2 part. Then run lsof /tmp/.X11-unix/X42; one of the processes that has that socket open is the X server. It's likely to be a virtual framebuffer X server like Xvfb, or it could be a server for a remote display framework such as VNC or NX.

If the value is of the form host:NUMBER, then the X display is remote. The X server is a process listening on port 6000+NUMBER. Run netstat -plnt | awk '$4 ~ ":" (6000 + NUMBER) "$"' {print $7} to show the PID of the process that's listening on that port. It's likely to be an ssh connection.

share|improve this answer
Why do you have netstat running with the -l and -a options? They do contradictory things. – Kevin M Oct 26 '11 at 15:51
@KevinM For no reason, here I'm looking for a listening socket so it should be -l. Thanks. – Gilles Oct 26 '11 at 16:30
Should also be noted that ssh X11 forwarding will often end up with DISPLAY being something like localhost:10 – derobert Dec 7 '11 at 5:14
  1. Since X11 is a Window system that allows the application server to be used to differ from the X server used, it is not neccessary to have a locally installed display.

  2. Best thing would be to check which is the parent of the running firefox, i.e check the Parent's PID in the ps output (you may have to look at its parent also...). BTW: If you have a command like ptree installed, this helps a lot.

  3. Annother indication would be the user-ID the process is using.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.