Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have two linux servers. Let's say they are C and S.
C is client of S

On my S machine, I type.

$ netstat -an | grep ESTABLISHED
tcp 0 0 192.168.1.220:3306 C:57010 ESTABLISHED

Then I can know C is connecting now.
In the C machine, I'd also like to know the process name which is opening the port 57010 and connecting the S server. How can I do that? Of course I have root permission of C.

share|improve this question
add comment

3 Answers

up vote 6 down vote accepted

One way is to say lsof -i:57010 -sTCP:ESTABLISHED. This walks the kernel's open file handle table looking for processes with an established TCP connection using that port. (Network sockets are file handles on *ix type systems.) You'd use -sTCP:LISTEN on the server side to filter out only the listener socket instead.

Because of the way lsof works, it can only see processes your user owns unless you run it as root. It's also fairly inefficient, since a typical *ix system has a lot of file handles open at any given time. The netstat method given in another answer is faster and usually has lower access requirements.

The lsof method has one great advantage, however: not all *ix type OSes have a netstat flag for including the process name in the output, whereas lsof has been ported to every *ix type OS you're likely to use. OS X's netstat is this way, for example. It has a -p option, but it does something different from netstat -p on Linux.

For an uncommon port number like the one in your question, you can typically get away without adding lsof's -s flag, because a given machine is unlikely to have programs both connecting to the port and listening on it. It can be helpful to add it with port numbers like HTTP's 80, where it is likely you'll have multiple programs using that port at once.

It's fortunate that the -s flag is optional in many situations, because that usage only works with lsof version 4.81 and newer. In older versions, -s meant something else entirely! That's a 2008 vintage change, but it can still bite unexpectedly. RHEL 5 ships with lsof 4.78, for example.

share|improve this answer
    
thanks for the kind answer. very helpful. –  Benjamin Jul 26 '12 at 12:02
add comment

You can use netstat -anp | grep 57010 on C but this will only work if there isn't any firewall in between which is mapping port 57010 to a different one.

share|improve this answer
    
oh, thank you. easy. Is there a way to see the process's command line arguments? –  Benjamin Jul 26 '12 at 8:45
3  
@Benjamin If you have process id nnn then ps waux | grep nnn will give you quite a bit of information. For more information yet, use cat /proc/nnn/cmdline though the spaces have been deleted (actually I think they are replaced by \0) so it is not easy to read. –  Huygens Jul 26 '12 at 9:00
    
+1 for mentioning port mapping/translation –  Michael Kjörling Jul 26 '12 at 12:25
add comment

Just for the sake of completeness:

Using ss from the new Linux networking utility tool-set (iproute2):

ss -tp sport = :57010 dst 192.168.1.220
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.