Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a service, keeping a certain port open.

I'm getting data to it, that I neither expect nor want to get, and I'm trying to pin-point the source of this data. So how can I find which process that sends data to a specific port, as opposed to which process is listening.

share|improve this question

For TCP (though the same approach would work for SCTP or any connection-oriented transport protocol), same as for looking for listening one

lsof -nPi tcp:the-port

Will report the processes that have a TCP socket open on that port. If you know the source port (your server application can know about it and log it), you can use that instead to pinpoint the rogue client.

For UDP or RAW sockets, it would be trickier though I suppose it's where something like systemtap or dtrace can come handy. Possibly auditd as well.

share|improve this answer

You may use sockstat command to find the process which has initiated connection to your service on the local host.

     The sockstat command lists open Internet or UNIX domain sockets.

Just match all source connections to your destination. This works fine for TCP/UDP/UNIXsockets.

share|improve this answer

Depending on the type of connection it establishes to send data one of these approaches will get you somewhere.

  • Use tcpdump port 1234 to acquire the data being sent to this port. You can use a program like Wireshark to analyze it on another machine (captured to a file using the -w option). Alternatively, use Wireshark directly.

  • In case it establishes and keeps open a tcp/udp connection you could use netstat to find the remote IP of the connection.

  • List open sockets of a process as in the answer provided by @StephaneChazelas.

share|improve this answer

On Solaris, running pfiles on all processes should show which processes have which connections open. It will require some careful filering, probably using ggrep's -A, -B options...

On Linux, netstat -anp --inet will work, even without lsof installed. (drop the --inet to get Unix domain sockets as well)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.