Tag Info

Hot answers tagged

13

Using lsof (as root): # lsof -i -n -P COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 3028 root 3u IPv4 7072 0t0 TCP *:22 (LISTEN) sshd 3028 root 4u IPv6 7074 0t0 TCP *:22 (LISTEN) iproute2's ss can do this, too (as root): # ss -lp State Recv-Q Send-Q Local Address:Port ...


8

As recommended by IBM: use lsof -i -n and look for port XY. If you want parseable output from lsof, use the -F flag and parse the output with awk. You can get pre-compiled binaries for AIX V5. I don't know if there are pre-compiled binaries for V6; if there aren't, get the source and compile it.


6

One way is to say lsof -i:57010 -sTCP:ESTABLISHED. This walks the kernel's open file handle table looking for processes with an established TCP connection using that port. (Network sockets are file handles on *ix type systems.) You'd use -sTCP:LISTEN on the server side to filter out only the listener socket instead. Because of the way lsof works, it can ...


6

Use the bash [[ conditional construct and prefer the $(<command>) command substitution convention. Additionally, [[ prevents word splitting of variable values therefore there is no need to quote the command substitution bit.. if [[ $(netstat -lnp | grep ':8080') == *java* ]]; then echo "Found a Tomcat!" fi


5

How (where) can I find out information about them, First you have to find out which program is bound to each port. Unfortunately, there is no single standard way to do that which will work on all *ix type systems, and your question doesn't specify one. Some versions of netstat have a flag which will include the associated program name on each output ...


5

Yes you can. Download it. But as you don't say what flavor of linux re you using here is couple of examples: Debian/Ubuntu related: # What package is the netstat executable in? apt-file search /usr/bin/netstat # Now download the source of that package apt-get source net-tools CentOS/Red Hat: yumdownloader --source net-tools


5

Another alternative is to simply test the exit status of grep itself, which will return false (1) if there was no match and true (0) if there was one, by not using the [ command. if netstat -lntp | grep ':8080.*java' > /dev/null; then echo "Found a Tomcat!" fi The redirection to /dev/null is to prevent it from also printing the found line to the ...


4

The man pages are your friends for info such as this: $ man netstat ... SYNOPSIS netstat [address_family_options] [--tcp|-t] [--udp|-u] ... Notice in the usage that those switches are the short forms of the GNU style switches --tcp and --udp.


3

Also you can use lsof utility. Need to be root. # lsof -i :25 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME exim4 2799 Debian-exim 3u IPv4 6645 0t0 TCP localhost:smtp (LISTEN) exim4 2799 Debian-exim 4u IPv6 6646 0t0 TCP localhost:smtp (LISTEN)


3

Try using netstat with rmsock. port=$1 addr=`netstat -Aan | grep $port | awk '{print $1}` pid=`rmsock $addr tcpcb | awk '{print $9}'` ps -ef | grep $pid For netstat, the -A shows the address of any protocol control blocks associated with the sockets, the -a option shows the state of all sockets including those of server processes, and the -n option gives ...


3

Your mistake is that you're associating the information on the netstat output with the interface rather than the destination. Destination addresses can have associated gateways. When you configure your network, you're associating interfaces and gateways with sets of destination addresses -- so the question you need to be asking is "what's the gateway for ...


2

This one is per interface and I am looking per socket. Then use just netstat i.e. uname -r 5.10 type netstat netstat is hashed (/usr/bin/netstat) netstat TCP: IPv4 Local Address Remote Address Swind Send-Q Rwind Recv-Q State -------------------- -------------------- ----- ------ ----- ------ ----------- localhost.53206 ...


2

# netstat -i Name Mtu Net/Dest Address Ipkts Ierrs Opkts Oerrs Collis Queue lo0 8232 loopback localhost 52559 0 52559 0 0 0 hme0 1500 sys11 sys11 18973 0 30292 0 0 0 This has a Queue column with In/Out packets. Does this meet you needs? Note: Ran on solaris 10


2

On Linux, you can set up the audit subsystem to log every attempt to establish a network connection. For information about the audit subsystem, read the auditctl man page or this tutorial or other examples on this site. Install your distribution's auditd package if necessary, then auditctl -A exit,always -S connect


2

The command netstat -a | grep LISTEN lists all the processes listening on various types of sockets. These sockets can be of any address families like ipv4 (udp or tcp), ipv6 (udp6 or tcp6), unix. The entries like: tcp 0 0 *:webmin *:* LISTEN tcp 0 0 *:ftp *:* ...


2

netstat is part of the net-tools suite. The project home page is here: https://developer.berlios.de/projects/net-tools/ You can browse the netstat source here: http://cvs.berlios.de/cgi-bin/viewvc.cgi/net-tools/net-tools/netstat.c?view=markup or download the netstat.c file.


2

The script in your answer has a race condition, the only way to avoid it is to atomically check if it is open by trying to open it. If the port is in use, the program should quit with a failure to open the port. For example, say you're trying to listen with netcat. #!/bin/bash read lowerPort upperPort < /proc/sys/net/ipv4/ip_local_port_range while :; do ...


2

They're covered here in the guide: Linux Network Administrators Guide Chapter 5. Configuring TCP/IP Networking. excerpt The last column shows the flags that have been set for this interface. These characters are one-character versions of the long flag names that are printed when you display the interface configuration with ifconfig: B = A broadcast ...


2

The column after local address is "Foreign Address" - as these are UDP ports, and listening ports, there is no foreign address so a wildcard is shown. I'm not sure if this would show the other end(s) if packets had been received as UDP is a connectionless protocol. Also as one-many comms is allowed a single foreign address could be misleading. So it may ...


2

for what its worth... depending on the version of netstat (specifically GNU netstat) you have, you can use netstat -punta | grep <port> this will show you connections in ESTABLISHED and LISTEN states UDP and TCP and it will ignore the UNIX local sockets. the end result is a nice, neat, small result set. the -p flag will give you the process ID ...


2

Two ways: lsof -i :port -S netstat -a | grep port You can do man lsof or man netstat for the needed info. Replace port by the port number you want to search for.


2

To check which programs is listening on a port. The command netstat has options to show listened ports and programs/pids, I usually disable DNS look up as well. netstat -nlp or just tcp ports netstat -nltp man netstat for further reading and all options.


1

The manpage and netstat --help both say [--tcp|-t] [--udp|-u] in the synopsis. That's more than a hint - this syntax pretty clearly states that -t is the same as --tcp and that -u is the same as --udp. You're right though that the manpage doesn't document --tcp and --udp. netstat --help shows that --tcp and --udp are two of the several socket selectors that ...


1

On Linux, you could do something like: ss -tln | awk 'NR > 1{gsub(/.*:/,"",$4); print $4}' | sort -un | awk -v n=1080 '$0 < n {next}; $0 == n {n++; next}; {exit}; END {print n}' To find the first free port above 1080. Note that ss -D would bind on the loopback interface, so in theory you could reuse port 1080 if a socket has it bound on ...


1

The iptables rule is just saying that any incoming TCP segment with destination port 143 will be accepted and not e.g. DROPped when default chain policy is set to DROP or REJECTed when the segment is not matched by any rule and the last rule in the chain is REJECT. If you want to see this port as opened and in listening state there has to be some ...


1

Is there a service running on that port after you've opened it? The command netstat -tulpn | less will only show you the ports of daemons that are actually listening on TCP ports. Example Nothing's initially running: $ sudo netstat -tulpn | grep :80 $ Start up Apache: $ sudo /etc/init.d/httpd start Starting httpd: ...


1

UDP is a connectionless protocol. SS probably won't show one in LISTEN state, only in UCONN or ESTAB. If I do this, $ nc -u -l 2333 Then ss will show (in a 2nd shell): $ ss -au|grep 2333 UNCONN 0 0 *:2333 *:* If I then connect to it (3rd shell) $ nc -u localhost 2333 then SS shows: $ ss ...


1

As far as i know, you can't (except on BSD systems, where Finkregh's solution works fine). It might be possible but you don't care, because most application listen on every interface, even when bound to an IP address. On linux (and openwrt), the only way for an application to listen only on a certain interface is the SO_BINDTODEVICE socket option. Few ...


1

You can do more precise, yet simple, matching with awk. if netstat -lnp | awk '$4 ~ /:8080$/ && $7 ~ /java/ {exit(0)} END {exit(1)}'; then … To match the structure of your command more closely, the portable way of doing wildcard matching on a string in a shell is with the case construct. case "$(netstat -lnp | grep ':8080')" in *java*) echo ...


1

Add this sed command at the end of your pipe. It does a greeding search until last . and delete it and all digits that follow it. ... | sed -e 's/^\(.*\)\.[0-9]*/\1/' It yields: tcp4 0 0 61.129.65.176.80 123.120.207.172 ESTABLISHED tcp4 491 0 61.129.65.176.80 171.250.180.211 ESTABLISHED tcp4 286 0 ...



Only top voted, non community-wiki answers of a minimum length are eligible