Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In the output of

netstat -a | grep LISTEN

there are usually a lot of processes. How (where) can I find out information about them, what is their purpose in the system and if I can kill them? Which of them can be insecure and which are safe?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

How (where) can I find out information about them,

First you have to find out which program is bound to each port. Unfortunately, there is no single standard way to do that which will work on all *ix type systems, and your question doesn't specify one.

Some versions of netstat have a flag which will include the associated program name on each output line. For instance, --program in Linux or -b on Windows.

If your netstat doesn't have such a flag (e.g. OS X), you will have to find another method that works on your system. lsof -i, /proc spelunking, etc.

what is their purpose in the system

Once you have the program name in hand, man progname will usually give you enough information to answer that question yourself.

[can I] kill them?

You will figure that out once you know what each server is doing.

A single answer here is not the right place for a list of all the things you can kill. There are simply too many possibilities. If you're unsure about a given program after reading its documentation, you can post another question here asking about it. Some things are fairly obvious (e.g. sshd), others more obscure (e.g. avahi).

Which of them can be insecure and which are safe?

It's rare for a program to be running by default on a new *ix system which is absolutely insecure.

(In the bad old days, that wasn't the case. You'd often see systems running telnetd, non-chrooted ftpd, the r* commands...)

Any non-default background TCP listener should be something you or another trusted admin installed, so presumably you've already come to grips with any safety concerns.

There are gray areas here. You might have a server running which is not absolutely insecure, but which is conditionally insecure. Maybe it's not locked down properly, maybe it has unpatched bugs, etc. That's the stuff of entire computer security careers, though, not something suitable for answering here in a single question. Lacking that experience, Google is probably your best first resort. If you don't find what you need there, you can post a new question here about a particular server.

share|improve this answer
    
Thank you for answer. When I use netstat -a --programs | grep LISTENING 90 % of processes have instead of the program name only -. I'd like to be able to get some information about these too. –  xralf Apr 12 '12 at 17:27
3  
A - in that field means one of two things. Since you say 90%, the most likely reason is that the listening program isn't owned by you, so the kernel can't look the program name up for you. Run netstat as root to get all program names. It can also mean the port isn't owned by a user process. An example would be port 2049, which is part of NFS, which is in the kernel on Linux. You can get clues about this sort of thing from the human-readable service name in the netstat output ("nfs" in this case) or get the port number with netstat -n and look it up other ways. –  Warren Young Apr 12 '12 at 17:36
    
Running as root helped. Names are already there. The program in most cases is 1630/master and it has associated various processes. Can I found out some info about this program? Google gives irrelevant results. –  xralf Apr 12 '12 at 18:01
    
@xralf: Edit your answer with the output, it would be better..not whole output but some part atleast –  pradeepchhetri Apr 12 '12 at 18:20
1  
With such a generically named program, you're going to have something of a challenge. I'd first try to find out where that program lives on disk (locate -r /master$, or find /usr -type f -perm +111 -name master or find /opt samestuffagain or...) then query the system's package manager to see if it was installed that way. If so, the package should lead you to its creator. If it was installed from source or a binary tarball, the mystery will be harder to solve. But, you're really stretching the bounds of the "one question one answer" StackExchange Q&A format now. –  Warren Young Apr 12 '12 at 18:27

The command

netstat -a | grep LISTEN

lists all the processes listening on various types of sockets. These sockets can be of any address families like ipv4 (udp or tcp), ipv6 (udp6 or tcp6), unix.

The entries like:

tcp        0      0 *:webmin                *:*                     LISTEN
tcp        0      0 *:ftp                   *:*                     LISTEN

means tcp protocol is used and some server is running in your machine like in my case webmin and ftp server are running.

The entries like:

 tcp6       0      0 [::]:8484               [::]:*                  LISTEN     
 tcp6       0      0 [::]:netbios-ssn        [::]:*                  LISTEN     

means tcp6 protocol of ipv6 is used.

The entries like:

unix  2      [ ACC ]     STREAM     LISTENING     13297    /tmp/orbit-pradeep/linc-76d-0-53b2963d93f75
unix  2      [ ACC ]     STREAM     LISTENING     13305    /tmp/orbit-pradeep/linc-775-0-5ddd91eb9510b

are created by ORBit CORBA. This Common Object Request Broker Architecture (CORBA) is a standard defined by the Object Management Group (OMG) that enables software components written in multiple computer languages and running on multiple computers to work together i.e., it supports multiple platforms.

1. How (where) can I find out information about them ?

Suppose I want to find information about /tmp/orbit-pradeep/linc-775-0-5ddd91eb9510b. I can find out the details by executing the following command:

$ lsof -Pwn | grep /tmp/orbit-pradeep/linc-775-0-5ddd91eb9510b

This command gave the output:

indicator  1909    pradeep   10u  unix 0xf6bd8900          0t0      13305 /tmp/orbit-pradeep/linc-775-0-5ddd91eb9510b
indicator  1909    pradeep   12u  unix 0xf6b1f600          0t0      13314 /tmp/orbit-pradeep/linc-775-0-5ddd91eb9510b

Here:

indicator is the name of the unix command associated with the process. 1909 is the PID of the indicator process.

2. what is their purpose in the system ?

Some processes like

tcp        0      0 *:ftp                   *:*                     LISTEN

are for listening of an FTP server.

Others like:

 unix  2      [ ACC ]     STREAM     LISTENING     13297    /tmp/orbit-pradeep/linc-76d-0-53b2963d93f75

are meant for interprocess communication between different processes used by CORBA.

3. Can I kill them?

That depends upon the criticality of the process. Suppose if you kill any server listening then it will cease all communication related to that server.

4. Which of them can be insecure and which are safe ?

All are secure processes.

share|improve this answer
    
Thank you, I will create new question that builds on this information. –  xralf Apr 12 '12 at 18:58

netstat -nap | grep LISTEN will give the below output, which will include the name and the pid of the listening processes:

unix  2      [ ACC ]     STREAM     LISTENING     20763  2333/gnome-terminal /tmp/orbit-eugene/linc-91d-0-2dbe139bd35e3
unix  2      [ ACC ]     STREAM     LISTENING     17900  2014/bonobo-activat /tmp/orbit-eugene/linc-7de-0-2b0c0606f265
unix  2      [ ACC ]     STREAM     LISTENING     18325  2274/gnome-screensa /tmp/orbit-eugene/linc-7ef-0-59f130216cc19

-n - Show numerical addresses instead of trying to determine symbolic host, port or user names.

-a - Show both listening and non-listening sockets.

-p Show the PID and name of the program to which each socket belongs.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.