How can I identify processes that use network facilities, and can they be killed?

Question

In the output of

netstat -a | grep LISTEN

there are usually a lot of processes. How (where) can I find out information about them, what is their purpose in the system and if I can kill them? Which of them can be insecure and which are safe?

Answer 1

How (where) can I find out information about them,

First you have to find out which program is bound to each port. Unfortunately, there is no single standard way to do that which will work on all *ix type systems, and your question doesn't specify one.

Some versions of netstat have a flag which will include the associated program name on each output line. For instance, --program in Linux or -b on Windows.

If your netstat doesn't have such a flag (e.g. OS X), you will have to find another method that works on your system. lsof -i, /proc spelunking, etc.

what is their purpose in the system

Once you have the program name in hand, man progname will usually give you enough information to answer that question yourself.

[can I] kill them?

You will figure that out once you know what each server is doing.

A single answer here is not the right place for a list of all the things you can kill. There are simply too many possibilities. If you're unsure about a given program after reading its documentation, you can post another question here asking about it. Some things are fairly obvious (e.g. sshd), others more obscure (e.g. avahi).

Which of them can be insecure and which are safe?

It's rare for a program to be running by default on a new *ix system which is absolutely insecure.

(In the bad old days, that wasn't the case. You'd often see systems running telnetd, non-chrooted ftpd, the r* commands...)

Any non-default background TCP listener should be something you or another trusted admin installed, so presumably you've already come to grips with any safety concerns.

There are gray areas here. You might have a server running which is not absolutely insecure, but which is conditionally insecure. Maybe it's not locked down properly, maybe it has unpatched bugs, etc. That's the stuff of entire computer security careers, though, not something suitable for answering here in a single question. Lacking that experience, Google is probably your best first resort. If you don't find what you need there, you can post a new question here about a particular server.

Answer 2

The command

netstat -a | grep LISTEN

lists all the processes listening on various types of sockets. These sockets can be of any address families like ipv4 (udp or tcp), ipv6 (udp6 or tcp6), unix.

The entries like:

tcp        0      0 *:webmin                *:*                     LISTEN
tcp        0      0 *:ftp                   *:*                     LISTEN

means tcp protocol is used and some server is running in your machine like in my case webmin and ftp server are running.

The entries like:

 tcp6       0      0 [::]:8484               [::]:*                  LISTEN     
 tcp6       0      0 [::]:netbios-ssn        [::]:*                  LISTEN     

means tcp6 protocol of ipv6 is used.

The entries like:

unix  2      [ ACC ]     STREAM     LISTENING     13297    /tmp/orbit-pradeep/linc-76d-0-53b2963d93f75
unix  2      [ ACC ]     STREAM     LISTENING     13305    /tmp/orbit-pradeep/linc-775-0-5ddd91eb9510b

are created by ORBit CORBA. This Common Object Request Broker Architecture (CORBA) is a standard defined by the Object Management Group (OMG) that enables software components written in multiple computer languages and running on multiple computers to work together i.e., it supports multiple platforms.

1. How (where) can I find out information about them ?

Suppose I want to find information about /tmp/orbit-pradeep/linc-775-0-5ddd91eb9510b. I can find out the details by executing the following command:

$ lsof -Pwn | grep /tmp/orbit-pradeep/linc-775-0-5ddd91eb9510b

This command gave the output:

indicator  1909    pradeep   10u  unix 0xf6bd8900          0t0      13305 /tmp/orbit-pradeep/linc-775-0-5ddd91eb9510b
indicator  1909    pradeep   12u  unix 0xf6b1f600          0t0      13314 /tmp/orbit-pradeep/linc-775-0-5ddd91eb9510b

Here:

indicator is the name of the unix command associated with the process. 1909 is the PID of the indicator process.

2. what is their purpose in the system ?

Some processes like

tcp        0      0 *:ftp                   *:*                     LISTEN

are for listening of an FTP server.

Others like:

 unix  2      [ ACC ]     STREAM     LISTENING     13297    /tmp/orbit-pradeep/linc-76d-0-53b2963d93f75

are meant for interprocess communication between different processes used by CORBA.

3. Can I kill them?

That depends upon the criticality of the process. Suppose if you kill any server listening then it will cease all communication related to that server.

4. Which of them can be insecure and which are safe ?

All are secure processes.

Answer 3

netstat -nap | grep LISTEN will give the below output, which will include the name and the pid of the listening processes:

unix  2      [ ACC ]     STREAM     LISTENING     20763  2333/gnome-terminal /tmp/orbit-eugene/linc-91d-0-2dbe139bd35e3
unix  2      [ ACC ]     STREAM     LISTENING     17900  2014/bonobo-activat /tmp/orbit-eugene/linc-7de-0-2b0c0606f265
unix  2      [ ACC ]     STREAM     LISTENING     18325  2274/gnome-screensa /tmp/orbit-eugene/linc-7ef-0-59f130216cc19

-n - Show numerical addresses instead of trying to determine symbolic host, port or user names.

-a - Show both listening and non-listening sockets.

-p Show the PID and name of the program to which each socket belongs.